/poam-review
Review and manage Plan of Action & Milestones (POA&M)
$ npx -y skills add GRCEngClub/claude-grc-engineering --agent claude-codeHow it fires
How this command gets triggered: by you, by Claude, or both.
- Fires itselfClaude auto-loads it when your prompt matches the work.
- You can call itInvoke it directly when you want it.
- Slash command
/poam-review
Context preview
What this command does when you run it.
Review and manage Plan of Action & Milestones (POA&M)
Command definition
poam-review.mddescription: Review and manage Plan of Action & Milestones (POA&M)
POA&M Review
Analyzes and provides guidance on FedRAMP Plan of Action & Milestones.
Arguments
- `$1` - POA&M file or action (required)
- `$2` - Analysis type (optional: gaps, priorities, aging)
POA&M Requirements
Each POA&M item must include:
- Weakness description
- Point of contact
- Resources required
- Scheduled completion date
- Milestones with dates
- Status updates
- Risk level (High/Moderate/Low)
Analysis Types
- **gaps** - Identify missing required fields
- **priorities** - Rank items by risk and due date
- **aging** - Flag overdue items and extensions needed
FedRAMP POA&M Rules
- High vulnerabilities: 30 days to remediate
- Moderate vulnerabilities: 90 days to remediate
- Low vulnerabilities: 180 days to remediate
- Operational requirements may extend timelines
Example
/fedramp-rev5:poam-review ./poam.xlsx priorities
Open-source GRC Engineering resource for Claude. claude-grc-engineering turns technical evidence from cloud, SaaS, code, and security tools into framework-aligned findings, gap reports, remediation guidance, evidence packages, and OSCAL workflows.
Repo: GRCEngClub/claude-grc-engineering
Other commands on trust-center.
- /research
Start or resume an academic research project — idea through literature, methodology, writing, feedback, and publishing
Open command - /collect
Query AWS for compliance-relevant configuration across IAM, S3, CloudTrail, EBS, and emit findings conforming to the v1 contract.
Open command - /setup
Install the frdocx-to-froscal-ssp Python pipeline and verify its dependencies. Idempotent.
Open command - /status
Check the deployment status of the trust center.
Open command - /scan
Run testssl.sh against one or more HTTPS endpoints and emit v1 Findings mapped to SOC 2, NIST 800-53, PCI DSS 4.0.1, ISO 27001, and SCF controls.
Open command - /compliance-posture
Serve a localhost compliance posture dashboard from monitor-continuous JSON
Open command