Exceptions, POA&M & Remediation Tracking
Tracks accepted risk and agreed fixes to closure.
Overview
Every real program has controls it cannot meet yet. The governance question is whether those gaps are recorded, time-bounded, owned and approved at the right level — or invisible. A Plan of Action and Milestones is the federal formalisation of this, with FedRAMP enforcing 30, 90 and 180-day remediation windows measured from discovery. Commercially the same object appears as a risk acceptance or control exception with an expiry date and a named approver. The failure mode is identical everywhere: exceptions granted, never reviewed, quietly permanent.
Undocumented accepted risk is the most common finding in any first external assessment.
Advantages
- Forces an explicit, dated, named decision instead of a silent gap
- Expiry dates and re-approval stop temporary exceptions becoming architecture
- POA&M format is what federal assessors and CMMC C3PAOs expect to receive
- Aggregated exceptions reveal where a control is systemically unworkable, not just locally inconvenient
- Linking exceptions to risks puts a cost on the accepted position
Trade-offs
- Becomes a rubber stamp if approval authority is set too low
- Federal POA&M formats are rigid and unforgiving of sloppy dates or milestones
- Duplicate trackers — one in GRC, one in Jira, one in a spreadsheet — are the norm and defeat the purpose
- Remediation windows measured from discovery punish teams that find things quickly
- Volume alone tells you nothing without severity and age weighting
Open-source option
Eramba tracks exceptions with expiry and approval, and OSCAL defines a machine-readable POA&M model that open tooling such as compliance-trestle can author and validate. What open source lacks is the federal submission workflow, the continuous-monitoring deadline enforcement, and the assessor-facing package assembly that RegScale, Xacta and Paramify are bought for.