Free tool for FedRAMP Rev5 and 20x

POA&M to FedRAMP Vulnerability Report Converter

Convert a Plan of Action and Milestones (POA&M) spreadsheet and optional deviation requests into the Vulnerability Detail Report and Accepted Vulnerability Info JSON files to help meet the vulnerability reporting requirements in the FedRAMP Consolidated Rules for 2026.

VDR and VER adoption date: 7 December 2026FedRAMP JSON schemas: 2026-06-24

Import files

Start with your POA&M

Drop a workbook or CSV here, up to 10 MB.

Files stay in this browser. Reloading clears your session.

Deviation requests Optional

Add the FedRAMP deviation request form to match requests by POA&M ID.

Sample files POA&M workbook · Deviation requests

Worked example: one POA&M finding

See how a fictional OpenSSH finding becomes a Vulnerability Detail Report record for a Rev5 Class C service, as of 6 November 2026.

POA&M spreadsheet row

POA&M ID: V-1001
Weakness: OpenSSH signal handler race condition
CVE: CVE-2024-6387
Original risk: High
Detected: 20 October 2026
Detection source: Nessus
Deviation request: None
Scheduled completion: 20 November 2026

You confirm the evaluation. This finding was evaluated on 21 October 2026 as internet-reachable and likely exploitable, with Potential Agency Impact rated N4.

Vulnerability Detail Report record

{
  "providerTrackingId": "V-1001",
  "detection": {
    "detectedAt": "2026-10-20T00:00:00Z",
    "detectionSource": "Nessus"
  },
  "vulnerabilityDescription": "OpenSSH signal handler race condition (regreSSHion) (CVE-2024-6387). OpenSSH server on the bastion hosts is vulnerable to unauthenticated remote code execution.",
  "evaluationCompletedAt": "2026-10-21T00:00:00Z",
  "isInternetReachable": true,
  "isLikelyExploitable": true,
  "currentRating": 4,
  "projectedNextReduction": {
    "estimatedAt": "2026-11-20T00:00:00Z",
    "targetRating": 0
  },
  "overdueStatus": {
    "isOverdue": true,
    "explanation": "Past the VDR-TFR-PVR timeframe of 4 days from evaluation (Class C, N4, Internet-reachable and likely exploitable (IRV + LEV)), due 2026-10-25."
  },
  "supplementaryRiskInformation": "Remediation plan: Upgrade OpenSSH to 9.8p1 on both bastion hosts."
}

How FedRAMP vulnerability reporting changes in 2026

The Vulnerability Evaluation and Reporting (VER) rules set out two machine-readable reports for FedRAMP Rev5 and 20x providers.

Vulnerability Detail Report

Covers open findings and relevant closures. Accepted findings go in the separate report. Providers make the detail report available on a recurring basis. VER-RPT-VDT · VER-RPT-PER

View the detail report schema

Accepted Vulnerability Info

Records accepted findings and why the provider accepted them, including vulnerabilities that won't be fully mitigated or remediated within 192 days of evaluation. VER-RPT-AVI · VER-TFR-MAV

View the accepted vulnerability schema

A confirmed false positive is reported as a closed finding. An operational requirement needs an acceptance rationale. A legacy risk adjustment can suggest an N-rating for you to review. VER-EVA-EFP · VER-EVA-EPA

Rule text from FedRAMP/rules 2026.10.13.01.

How POA&M columns map to the new reports

The converter carries over tracking IDs, descriptions, detection data, and remediation dates. You confirm reachability, exploitability, evaluation time, and Potential Agency Impact. The downloadable gap summary records what each report used and which source fields were omitted.

See the full column mapping

POA&M column	How it is used
POAM ID	Tracking ID
Weakness Name	Description
Weakness Description	Description
CVE	Description
Weakness Detector Source	Detection source
Original Detection Date	Detection date and time
Scheduled Completion Date	Projected next reduction
Status Date	Reduction date for closed items
Original Risk Rating	Suggested N-rating
Adjusted Risk Rating	Suggested N-rating after a risk adjustment
Risk Adjustment	Risk adjustment
False Positive	Final disposition: False Positive
Operational Requirement	Accepted vulnerability
Deviation Rationale	Acceptance rationale or supplementary information
Vendor Dependency	Supplementary information
Binding Operational Directive 22-01 tracking	Supplementary information (KEV)
Binding Operational Directive 22-01 Due Date	CISA KEV catalog due date
Overall Remediation Plan	Supplementary information
Comments	Supplementary information

Gap summary only. Controls, Asset identifier, Point of contact, Resources required, Planned milestones, Milestone changes, Supporting documents, Service name, Weakness source identifier.

Omitted from deviation requests. CVSS scores and metrics, JAB and agency review columns.

Frequently asked questions

Does the POA&M go away under the 2026 FedRAMP rules?

As the format you send FedRAMP, yes. Providers report vulnerability detection and response activity persistently (VER-RPT-PER) with the fields in VER-RPT-VDT, as JSON valid against FedRAMP's Vulnerability Detail Report schema. Accepted vulnerabilities go in a second document under VER-RPT-AVI. Agencies may still keep their own POA&Ms from what you report.

What happens to deviation requests?

The 2026 rules call for reporting dispositions and accepted vulnerabilities. A confirmed false positive is closed with the disposition "False Positive". An operational requirement or a vulnerability accepted under the 192 days rule (VER-TFR-MAV) needs an acceptance rationale. A legacy risk adjustment can suggest an N-rating that you still need to confirm.

Do the new vulnerability reports apply to Rev5 too?

Yes. The VDR and VER rules apply to 20x and Rev5, with 7 December 2026 as the date to comply. The VDR and VER timelines page lists every date by class.

Is my POA&M uploaded anywhere?

Your browser reads the spreadsheet and generates the reports on your device. Reloading the page clears the converter session.

Why does the converter ask questions?

The report needs the date you completed evaluation, whether the vulnerability is internet-reachable (VER-EVA-EIR), whether it is likely exploitable (VER-EVA-ELX and VER-EVA-AIA), and its Potential Agency Impact N-rating (VER-EVA-EPA). The converter suggests a rating from your POA&M as a starting point.

What does schema validation tell me?

Validation checks the format against FedRAMP's published JSON schemas. Review the source data, your answers, and the gap summary before sharing the reports with your assessor.

What does Boundera add after the conversion?

Boundera connects to your scanners, proposes evaluations with supporting evidence, tracks vulnerability deadlines, and keeps both reports current.

FedRAMP vulnerability reporting resources

Look up your deadlines and read the FedRAMP vulnerability reporting rules.