13. Updating the eMASS POA&M

The POA&M Update tab on the Reports page is where you build the file you upload back to eMASS. It is the one place in NESSviewer where you are not reading your POA&M but writing it.

13.1 What this screen is for

The POA&M editor on the Files page is review-only: it shows you what is wrong with the POA&M you have loaded. This screen is where you compose the corrections and produce the import file.

	Files → eMASS POA&M	Reports → POA&M Update
Input	One eMASS POA&M export	The loaded POA&M plus your scan data plus a saved working document
Editing	None — review only	Every POA&M field, plus milestones
Scope	Every item in the file	Only the items you deliberately pulled in
Output	A grid export	The eMASS import file, and a change log

Three things feed items into an update:

Action	What it does
Add	Open findings that have no POA&M item yet become new items. The POA&M Item ID is left blank for eMASS to assign.
Update	Existing items are refreshed — status set to Ongoing, Devices Affected brought back in line with the scan.
Close	Existing items are marked Completed with today’s date.

13.2 Before you start

Load the eMASS POA&M export on the Files page, and load the scans. The Update tab compares against both, and it will tell you when either is missing rather than quietly producing a wrong answer.

13.3 The workflow

1. Press New… to create an update document (offered as POAM_Update.json), or open an existing one from Browse or the recent-files list.

2. Check the project bar — it confirms the update is tied to the POA&M and scans you actually have loaded.

3. Set the values new items should inherit under POA&M Default Values, then press Save Defaults.

4. Pull items in with Add from Open Findings…, Update Existing Items… and Close Existing Items….

5. Press Review {n} problem(s) to see everything blank or disagreeing with the scan, each with the fix it would apply. Tick what you want and press Apply selected.

6. Edit individual items in the drawer, and use Update Selected to set a field across many rows at once.

7. Press Review Changes… to see exactly what the upload will alter, and export that list as your record.

8. Choose the Template: and press Export to eMASS…. Upload the resulting file to eMASS.

Note

There is no Save button. The update document saves itself a fraction of a second after every edit — the document is the session. The one you used last reopens automatically next time.

13.4 The project bar — are these the right files?

Uploading one system’s corrections against another system’s POA&M is the single most expensive mistake available on this screen. The project bar exists to stop it. It reads System: … · POA&M: … · Scans: … hosts and turns amber or red when something does not line up.

What it says	What it means
No eMASS POA&M is loaded…	Corrections, the Add list and the export all compare against the POA&M. Load it first.
This update was built for “X”, but the loaded POA&M is for “Y”…	Wrong project. Stop and check what you have open.
None of the {n} POA&M items this update changes are in the loaded POA&M…	Almost certainly another project’s POA&M.
{m} of the {n} POA&M items … are not in the loaded POA&M.	They may have been closed or removed in eMASS since the update was started.
No scans are loaded, so the Add list and the corrections have nothing to compare with.	Load the scans.
None of the {n} hosts in this update are in the loaded scans.	Probably another project’s scans.

Link to loaded POA&M ties an unlinked update to the POA&M you have open. If it is already linked to something else you are asked to confirm, because the only legitimate reasons are a rename in eMASS or an earlier mistake.

Important

The project bar warns; it never blocks. You can export an update built against the wrong POA&M. Read the bar before you export.

13.5 Defaults — fill them in first

POA&M Default Values holds the values new items inherit at the moment they are composed, so setting them before you add anything saves a great deal of correction afterwards. Four tabs:

Tab	What it sets
Item content	Office/Org, Resources, Comments, Predisposing Conditions, Threat Description, Identification Source and Controls / APs.
Risk and dates	The scheduled completion date, the Severity override, Relevance of Threat, Impact, and where Date Identified comes from for new items — Blank, First Identified or Scan Date.
Composed from scan data	Which fields of the finding are stitched together into the Vulnerability Description, and which identifier goes into Security Checks.
Milestones	Whether to use the finding’s own Fix text as the milestone description, the fallback text, the milestone Status and its scheduled date.

Every text field has a small pick button beside it — Pick from values already in the loaded POA&M — which saves typing a value your POA&M already uses, and spelling it differently.

Tip

Set a default late and you do not have to redo the items you already added: Fill Blanks from Defaults… writes defaults into items that were composed while that default was still blank, and never touches a field you have already filled in.

13.6 The update grid

Column	What it shows
Action	Add, Update or Close.
Changes	How much this row actually alters: New item, No changes, 1 change or {n} changes.
Validation	The row’s verdict: OK, or {n} blank, {n} vs scan, or both. Hover for every problem and its proposed fix.
POA&M Item ID	The eMASS identifier. Blank on Add rows.
Security Checks	The check identifier this item covers.
Status	The POA&M status.
Raw Severity	The eMASS raw severity.
Scheduled / Completed	The POA&M scheduled and completion dates.
Summary	The short title.
Vulnerability Description	The composed detail text.
Devices Affected	The hosts the finding is open on.

Note

A clean row says OK rather than showing nothing, deliberately — a blank cell reads as “not checked yet”, which is the wrong reassurance entirely.

13.7 Reviewing problems

Review {n} problem(s) opens one list containing both kinds of problem: required fields left blank, and rows the scan disagrees with. Each row names the issue, what is wrong, the field it would write, what is there now and what it would become.

What the scan comparison checks

Issue	What it detects	Proposed fix
Not open in test results	The item is Ongoing, but no matching test result is open.	Set status to Completed.
Gone from the scans	The item is Ongoing and its check appears nowhere in the loaded scans.	Set status to Completed.
Devices Affected	Hosts open in the scan but missing from the item, or listed there and no longer open.	Rewrite Devices Affected from the scan.
Raw Severity	The item’s severity disagrees with the scan.	Take the scan’s value.
Assets not scanned properly	Named assets were scanned without credentials, or their scan failed.	None. This needs a rescan or a decision, not a value.
Milestone expired	The last milestone’s date has passed.	Move it to 90 days from today.
Milestone due soon	The last milestone falls due within 30 days.	The same.
No milestone	The item has no milestone, so nothing states when it will be resolved.	Add one: To be determined, status Open, due in 90 days.

Important

A host the scans simply do not cover is never treated as evidence of anything. An unloaded result, an asset that did not respond, a scan that did not finish — none of these will cause a host to be removed from Devices Affected. Absence of data is not proof of a fix.

Which fixes are pre-ticked

Proposals arrive ticked only when their value was read off the scan. Anything suggested — every date — starts unticked, because, as the screen itself puts it, nobody but you knows when the work lands. Select all ticks everything that can be applied; Apply selected applies only what you ticked and writes only the one field each fix names.

What counts as required

On a POA&M update almost every field is required, so it is easier to say what is not. eMASS itself always insists on the vulnerability description, status, identification source, office, resources and the full risk chain. A further set — Security Checks, Controls / APs, Comments, Identification Source Details, Devices Affected, Predisposing Conditions, Threat Description, Impact Description, Recommendations and milestone status comments — is required by default but can be switched off under Options → POA&M Rules → Required fields for anything your programme does not track.

Completing an item adds two more: a POA&M completion date, and a completion date on at least one milestone.

13.8 Editing one item

Click a row to open the drawer. It has five tabs:

Tab	Contents
Item	Status, dates, summary, vulnerability description, controls, identification source, office, resources, comments, devices affected, mitigations and recommendations.
Risk	The raw severity and the risk chain — see below.
Milestones	A grid of milestones with Add Milestone, each row removable.
Validation	This item’s problems, with Apply ticked fixes.
Changes	Exactly what this item alters against the loaded POA&M.

How the risk ratings work

Six POA&M fields carry a risk rating, and only three of them are yours to set:

Field	How it is set
Severity, Relevance of Threat, Impact	Seeded from Raw Severity using the table under Options → POA&M Rules → Risk calculation, then editable.
Likelihood	Calculated from Severity and Relevance of Threat.
Residual Risk Level	Calculated from Likelihood and Impact.
Resulting Residual Risk	Follows the residual risk level.

The ratings are Very Low, Low, Moderate, High and Very High. Editing one of the three inputs recalculates the derived three immediately; editing Raw Severity reseeds all three inputs and then recalculates. The combination matrix itself is fixed and is the standard risk matrix.

Note

The same rules check the POA&M you have loaded. A row whose residual risk does not follow from its own inputs is flagged on the Files page’s eMASS POA&M tab, which is usually how you discover that someone has been setting residual risk by hand.

13.9 Changing many items at once

Tick rows in the grid and press Update Selected. The dialog groups 25 fields under Identification, Status & Dates, Risk, Narrative and Scope & Resources.

Only the fields you tick are written, so you can set an office across forty items without disturbing anything else. Typing a value ticks its box for you; ticking a field and leaving it empty clears that field on every selected row, which is how you blank something deliberately.

Important

Remove Selected drops rows from the update. It does not close an item or change anything in eMASS — it simply takes those rows out of the file you are building.

13.10 Checking what the upload will do

Review Changes… lists every field-level difference against the loaded POA&M, as Item, Field, Change, Before and After. A change is one of Added, Changed, Cleared, Milestone added or Milestone removed.

Export Changes… saves that list as POAM_Update_Changes.xlsx.

Tip

Export the change log every time and keep it with the package. The eMASS import file sends whole rows whether or not they changed, so it is not evidence of what you altered — the change log is the only artefact that shows what the upload actually did.

Note

The comparison is sensible about whitespace: blank and empty are equivalent, line endings are normalised, and Devices Affected is compared as an unordered set of hosts rather than as text. Reordering a host list is not a change.

13.11 Exporting to eMASS

Choose the Template: — Match loaded POA&M, Navy, Air Force or Army — and press Export to eMASS…. The file is offered as POAM_Update_eMASS_Import.xlsx and you choose where it goes. Match loaded POA&M follows the template of the file you have open, falling back to Navy if it cannot tell.

The workbook is written in the eMASS import template: the CUI banner on the first row, the system information block, the column headers on row 7, and one physical row per milestone with the item fields blank on continuation rows.

Important

An eMASS import replaces the whole row, so the export carries every field whether it changed or not. That is why the change log matters, and why a value you did not mean to set will still be uploaded.

Note

The grid toolbar’s own Excel export writes POAM_Update_Working_View_NOT_FOR_eMASS.xlsx. The name is deliberate — it is a working copy of what you are looking at, not an import file. Use Export to eMASS… for the real thing.

13.12 Common messages

Message	What it means
Create a new POA&M update file (New…) or open an existing one first.	No update document is open.
Load an eMASS POA&M first to pick existing items.	Update and Close need the POA&M loaded.
New POA&M items come from open findings in this application’s vulnerability data, which has not been provided.	No scan data is loaded.
Every open finding already has a POA&M item, or is already in this update.	Nothing left to add.
No open finding is past the POA&M aging thresholds yet.	Untick the filter to see newer findings too.
Nothing to correct — every item agrees with the loaded scans.	No problems to review.
Applied {n} correction(s). Nothing left to fix.	All problems resolved.
Applied {n} correction(s); {m} still flagged.	Some remain — usually suggested dates you left unticked.
This update changes nothing on the loaded POA&M.	Nothing to export as a change log.
Add items to the update first.	The update is empty.
Every item already matches the defaults.	Fill Blanks from Defaults… has nothing to do.