How to Create and Close a POA&M | Step-by-Step ISSO Tutorial

🚨 Want to break into DoD cybersecurity but don't have eMASS experience? Gain hands on experience with RMF Academy eMASS Lab Access and build the confidence employers are looking for. Link below 👇 https://www.rmfacademy.io/courses/RMF... 🚀 Ready to break into DoD cybersecurity? RMF Academy gives you the hands on training, practical resources, and real world guidance to build the skills employers are looking for. Link below 👇 https://www.rmfacademy.io/ Timestamps: 00:00 Introduction to ISSO Vulnerability Management 00:33 Understanding the Vulnerability Management Lifecycle 03:00 How ISSOs Discover Vulnerabilities 05:00 Understanding CVEs, CVSS, CISA KEV, and CPE 06:15 Investigating Vulnerabilities and System Applicability 07:00 Reviewing ACAS and Nessus Findings 08:15 Assessing Risk and Prioritizing Remediation 09:10 Assigning Vulnerabilities and Coordinating Remediation 10:15 Creating a POA&M 11:00 Understanding IAVM Alerts and Government Deadlines 12:00 Remediation and Validation 12:45 Vulnerability Management Workflow Recap 13:25 Learn More With RMF Academy Video Description: In this episode of the Tech Woke Podcast, I break down the ISSO vulnerability management workflow, showing how cybersecurity professionals identify vulnerabilities, review CVEs, assess risk, coordinate remediation, create POA&Ms, and track findings through closure. A lot of people studying RMF, GRC, and cybersecurity understand the definitions of vulnerability management and POA&Ms. But understanding how these processes actually work inside a government information system is a different story. In this video, I walk through the vulnerability management lifecycle from the perspective of an Information System Security Officer (ISSO) working in GovTech. In this video, we cover: How ISSOs identify and track vulnerabilities Understanding ACAS, Nessus, and STIG findings How to review CVEs and CVSS severity scores Understanding CISA alerts and the Known Exploited Vulnerabilities (KEV) Catalog How DoD IAVM notices and security directives work Reviewing vulnerability scan results Determining whether a vulnerability affects your system Assessing vulnerability risk and prioritizing remediation Understanding the responsibilities of ISSOs, ISSMs, system administrators, and system owners How to create and manage a Plan of Action and Milestones (POA&M) Assigning remediation responsibilities and tracking deadlines Validating remediation using vulnerability scans and technical evidence How to close out vulnerabilities and POA&Ms How vulnerability management supports the Risk Management Framework (RMF)