/poam-automation-expert

name: poam-automation-expert
description: "Expertise in FedRAMP POA&M lifecycle management, FedRAMP 20x VDR generation, and vulnerability classification using CISA KEV, EPSS, N-ratings, LEV/IRV, and NIST 800-53 control mappings."

POA&M Automation Expert

Tool Behavior

This connector wraps the FedRAMP POA&M Automation Tool — a Python CLI that manages the full vulnerability finding lifecycle from scanner import through FedRAMP 20x VDR generation.

What it does

• Parses raw scanner exports (Nessus, Tenable, Qualys, Wiz) into a structured FedRAMP POA&M
• Auto-deduplicates findings across scanner imports using title + asset identifier
• Enriches findings with NIST 800-53 control mappings via keyword matching
• Manages finding lifecycle: update, close, deviation (false positive / operational requirement)
• Generates FedRAMP 20x VDR reports with live CISA KEV and EPSS enrichment
• Generates per-release Product VDR reports for customer-facing vulnerability disclosure
• Outputs machine-readable JSON alongside every Excel report

VDR Classification Logic

Each finding is classified using live threat intelligence:

• **CISA KEV**: Finding CVE is checked against the live CISA Known Exploited Vulnerabilities catalog. KEV findings are bumped to minimum N3 adverse impact.
• **EPSS**: Exploit Prediction Scoring System score fetched from First.org API. Score ≥ 0.10 triggers LEV classification.
• **LEV/NLEV**: Likely Exploitable / Not Likely Exploitable. Determined by KEV membership, EPSS score, and severity fallback.
• **IRV/NIRV**: Internet Reachable / Not Internet Reachable. Derived from keywords in asset identifier and weakness description.
• **N-Rating**: N1 (lowest) to N5 (highest) adverse impact. Base rating derived from severity, then adjusted upward for KEV and IRV+LEV combinations.

Evaluation Deadlines

Per FedRAMP 20x baseline:

• High: 2 days from detection
• Moderate: 5 days from detection
• Low: 7 days from detection

Auto-Acceptance Threshold

Findings open 192+ days are automatically moved to the Accepted Vulnerabilities sheet per VDR-TFR-MAV.

Update Frequency Requirements

• High baseline: Weekly (every 7 days)
• Moderate baseline: Every 14 days
• Low baseline: Monthly (every 30 days)

Control Coverage

This connector maps findings to NIST 800-53 Rev 5 controls via keyword matching across 30+ control families including SI-2, RA-5, AC-2, AC-3, SC-8, SC-28, AU-2, CM-6, CM-7, and others.

Failure Modes

• **Missing openpyxl**: Install with `pip install openpyxl`
• **CISA KEV unavailable**: Offline fallback uses severity-based LEV classification
• **EPSS unavailable**: Offline fallback uses severity-based LEV classification
• **POA&M file open in Excel**: Close the file before running any write command
• **Duplicate findings**: Automatically skipped on import — same title + asset identifier

Limitations

• Product VDR requires a manually maintained vulnerability CSV — it does not auto-discover product vulnerabilities
• NIST control mapping is keyword-based, not authoritative — review mappings before submission
• AI remediation text requires Ollama running locally with the Mistral model