Authorization posture
Red6 item(s) past due
13 open POA&M · 0 review(s) overdue of 352 in scope
CA-7CA-5PM-9
Drill in ISO posture
Continuous-monitoring posture the Information System Owner reviews and forwards
Data as of23 Aug 2026
Cannot assert that monitoring is operating
6 of 9 posture areas have no telemetry in this workspace, and 2 measured area(s) are red. Continuous monitoring (CA-7) cannot be evidenced from feeds that do not exist. Image, STIG, boundary, and backup areas have no ingestion path yet, so this verdict stays unavailable until those feeds are wired up — it is not a page error.
3 measured · 6 no telemetry · 2 red · 0 amber
Posture heat map
Traffic lights only — drill in for detailPackage gate
Red5 blocking gate failure(s)
14 gate run(s) with results · 10 defined but never run
SR-3SR-4SR-5SR-11SA-10SA-15
Drill in Golden images
No telemetryNo image build feed
Prod/Test image SHAs and promotion state are not ingested, so drift from the last approved build cannot be detected.
Needs: Packer manifest.json per environment + promotion record
CM-2CM-3CM-8
OS STIG
No telemetryNo STIG scan results
No OS benchmark results are ingested, so CAT I findings and baseline drift are unknown.
Needs: OpenSCAP / SCAP results (CAT I–III) per image
CM-2CM-6SI-2
App STIG
No telemetryNo STIG scan results
No application benchmark results are ingested, so CAT I findings and baseline drift are unknown.
Needs: Application STIG checklist results per release
CM-6SI-2SA-11
Vuln DB & KEV
No telemetryNo scan feed
No vulnerability scan results are ingested. KEV exposure and High/Critical age cannot be reported — this is not the same as reporting zero.
Needs: scan-report.json + vulnerability DB import timestamp
RA-5SI-2SI-3SI-7
Open view Boundary / air-gap
No telemetryNo transfer log
Air-gap transfer events, hash verification, and live-pull attempts are not ingested, so unauthorized egress cannot be ruled out.
Needs: Guard/diode transfer log with hash verification per event
SC-7SC-8SR-3
Backup / recoverability
No telemetryNo backup feed
No backup or restore-test results are ingested, so recoverability is unproven.
Needs: Backup job results + last restore test (CP-4)
CP-4CP-9
Evidence freshness
GreenAll artifacts current
8 of 8 current
CA-7AU-6
Drill in Weekly ISO packet
Posture heat map, expiring exceptions, new High/Critical and KEV, failed gates, and evidence freshness — with every unmeasured area named.
- Measured
- 3 / 9
- No telemetry
- 6 / 9
- Red
- 2 / 9
- Amber
- 0 / 9
Feeds required before a CA-7 assertion
- Golden imagesPacker manifest.json per environment + promotion record
- OS STIGOpenSCAP / SCAP results (CAT I–III) per image
- App STIGApplication STIG checklist results per release
- Vuln DB & KEVscan-report.json + vulnerability DB import timestamp
- Boundary / air-gapGuard/diode transfer log with hash verification per event
- Backup / recoverabilityBackup job results + last restore test (CP-4)
Decisions the packet should carry
- RedAuthorization postureUpdate the POA&M milestone or extend it with documented ISO acknowledgment.
- RedPackage gateBlock publish until the blocking gate passes, or waive with an expiry date and compensating control.
Control-to-view map
Which view evidences which control family, and whether that view is backed by a live feed today.
| View | Primary 800-53 families | Feed |
|---|---|---|
| Package gate + SBOM + signatures | SR-3SR-4SR-5SR-11SA-10SA-15 | Live |
| Scan High/Critical fail | RA-5SI-2SI-3SI-7 | No telemetry |
| OS/App STIG on image | CM-2CM-3CM-6SI-2 | No telemetry |
| Dev/Test/Prod promote | CM-3CM-4SA-11 | No telemetry |
| Inventory of images/packages | CM-8 | No telemetry |
| Pipeline / transfer logs | AU-2AU-3AU-6AU-9AU-11 | Live |
| Air-gap / no live pull | SC-7SC-8SR-3 | No telemetry |
| Monitoring freshness | CA-7CA-5 | Live |