Epic: POA&M

[danswick]

Timeline

Beta Give feedback

1. Late Jan: All POA&Ms must be addressed, or progress documented and communicated.

We have POA&Ms to address.

https://docs.google.com/spreadsheets/d/1aWdrRDajovpgJ38ZBbH2OYc6HkyDLcVKVoH5XHvu-kw/edit#gid=1517858308

November

Beta Give feedback

1. FAC-D-2023-009 - Scanning at rest #2693
   3 of 3
   compliance eng +2
   

   
2. FAC-D-2023-012 - package-update #2696
   compliance +1
   
3. FAC-D-2023-013 - package-update #2697
   compliance +1
4. FAC-D-2023-002 - Caching #3120
   compliance eng +2
   
5. FAC-D-2023-005 - NR #2690
   2 of 2
   compliance infrastructure +2
   
6. FAC-D-2023-014 - NR #2698
   0 of 2
   compliance +1
   
7. FAC-D-2023-004 - AOR #2689
   compliance +1
   
8. FAC-D-2023-006 - SOP #2691
   compliance +1
9. FAC-D-2023-010 - Inherited #2694
   compliance +1
10. FAC-D-2023-011 - Cookies #2695
    compliance +1
11. FAC-D-2023-001 - 2023-11-14 #2688
    compliance +1
12. FAC-D-2023-015 - 2023-11-14 #2699
    compliance +1
    
13. FAC-D-2023-008 - 2023-12-14 #3119
    compliance +1
14. FAC-D-2023-016 - 2023-11-14 #2700
    compliance +1
    
15. FAC-D-2023-003 - Inherited #3121
    compliance +1
16. FAC-D-2023-017 - inherited #3122
    compliance +1
17. https://github.com/GSA-TTS/FAC/issues/3436

[danswick]

Need to understand updated timeline, document the work that has already happened.

[jadudm]

@danswick, I know we've pinged our ISSM on this, but I'm also unclear if everything is actually addressed. For example, are we running the scanner/can we run it in production? I'm going to bump the deadline out to the end of the month. I think everything is "done" in that we've documented/asked for clarification, and this ticket, once we know everything is done/accounted for, can/should close.

Any future POAM work can/should be picked up differently.

[danswick]

I added the one remaining PO&AM to the ATO epic.