by Mark a. Russo Cissp-Issap (Author)
A WELL-WRITTEN POAM IS KEY TO SUCCESS IN ANSWERING NIST 800-171 REQUIREMENTSThis is an ongoing series of supplements we are issuing regarding the changes in federal cybersecurity contracting requirements. It is designed to align with our groundbreaking cybersecurity book: Understanding Your Responsibilities in Meeting DOD NIST 800-171. Our desire is to provide complete how-to guidance and instruction to effectively and quickly address your businesses' need to secure your Information Technology (IT) environments to effectively compete in the federal contract space. This is designed to be a template, but much like "Understanding," is designed to capture critical elements of cybersecurity best practices and information that you can implement immediately. A POAM provides a disciplined and structured method to reduce, manage, mitigate, and ultimately, address an active POAM finding/vulnerability. POAM's provide findings, recommendations, and actions that will correct the deficiency or vulnerability; it is not just identifying the risk or threat but having a "plan" that reduces the danger to subjective determination, by the System Owner (business) that the control is met. A POAM is a Living-Document; you cannot just do it once and put it "on a shelf." Active Management of Security Controls is intended to protect your vital and sensitive data from loss, compromise or destruction. "Making the cryptic more comfortable(TM)."