diff --git a/content/documentation/poam/4-poam-template-to-oscal-mapping.md b/content/documentation/poam/4-poam-template-to-oscal-mapping.md index 2b821a9..aafa77f 100644 --- a/content/documentation/poam/4-poam-template-to-oscal-mapping.md +++ b/content/documentation/poam/4-poam-template-to-oscal-mapping.md @@ -20,7 +20,58 @@ includes: ### Representing the POA&M -This is based on the Excel-based [FedRAMP POA&M Template.](https://www.fedramp.gov/assets/resources/templates/FedRAMP-POAM-Template.xlsx) +The POA&M can be represented in two formats: + +#### Legacy Excel Format + +The legacy format uses the Excel-based [FedRAMP POA&M Template](https://www.fedramp.gov/assets/resources/templates/FedRAMP-POAM-Template.xlsx). When using this format in OSCAL, reference it in a resource assembly. Please note that this is not the preferred format, and upgrading to OSCAL content is advised: + +```xml + + Plan of Actions and Milestones (POAM) + + + + + + +``` + +#### OSCAL POA&M Format (Preferred) + +The OSCAL POA&M format represents the POA&M data natively in OSCAL XML. When using this format, include both the OSCAL XML rlink file reference. base64-encoded content is currently not supportted. + +```xml + + Plan of Actions and Milestones (POAM) + + + + + + 00000000 + +``` + +#### Network Component Links + +When network components need to reference specific POA&M items, use a link element with a resource-fragment that points to the POA&M item's UUID: + +```xml + +``` + +This links to a POA&M item defined as: + +```xml + + example poam item + +

poam item description

+
+ +
+``` Content that is common across OSCAL file types is described in the *[FedRAMP OSCAL Documentation](/documentation).*