A POA&M With Two High Findings and a Missed Milestone
A federal payroll shared service has been operating for three years. Its latest annual assessment found 2 High and 4 Moderate findings. The High findings are an unsupported database version with no vendor patch and an XML external entity vulnerability in a public-facing file upload. The vendor says a database migration will take 14 months; the file upload can be fixed in 30 days but has been delayed twice. The system processes 80,000 payments biweekly. The system owner proposes to close both High findings in the POA&M by documenting a web application firewall and network segmentation as compensating controls. The AO must decide whether to continue the authorization, issue a time-limited approval, or require immediate remediation. The CIO is concerned about payroll disruption; the CISO is concerned about exploitability. The POA&M currently shows the database item as ongoing with no milestone date.
1. Evaluate the proposal to close both High findings using compensating controls. What should the AO decide?
Read the worked answer
Compensating controls can support a decision to continue operation, but they do not close a finding. A finding is closed when the weakness is remediated and validated, or when the AO formally accepts the residual risk. The WAF and segmentation may reduce likelihood for the XXE and the database exposure, but the team must test whether they provide equivalent protection and document the result in the SSP and assessment. The XXE should be fixed in 30 days; that is a reasonable emergency change, and delaying it twice weakens the case for acceptance. The unsupported database is a High finding with a long vendor dependency. A time-limited authorization with conditions is more defensible than an open-ended ongoing POA&M: require isolation, enhanced monitoring, a migration plan with milestones, and a defined review date. The AO should document the risk decision, not let the POA&M hide it.
2. What must the POA&M contain, and how does ongoing authorization use it?
Read the worked answer
The POA&M must identify each weakness, the risk level, the affected controls, the planned remediation, resources, milestones, scheduled completion dates, status, and the vendor dependency. Ongoing with no date is not an acceptable milestone. Compensating controls should be listed with validation evidence and an owner. Risk acceptance should be recorded separately, with the AO signature, scope, duration, and review conditions. Ongoing authorization depends on ISCM: the AO uses security metrics, POA&M progress, incident data, and assessment results to decide whether the authorization remains valid. Set a review cadence, such as quarterly for High items. If the risk changes, a new exploit, a missed milestone, or a failed compensating control, the AO must reconsider.
3. The database migration is approved for next year. What authorization action does that trigger, and why is it not routine patching?
Read the worked answer
Replacing the unsupported database is a significant change to the security architecture, even if the function is unchanged. It requires an updated SSP, a revised assessment of the affected controls, and an AO decision before the change goes live. The migration also creates a chance to test data integrity, rollback, and interface behavior. Ongoing authorization can cover routine patching within the approved baseline; it cannot cover a major platform replacement. The agency should treat the migration as a project with security gates. If the migration slips again, the time-limited authorization conditions should trigger escalation rather than automatic extension.