An API and client for managing STIG assessments

compliance assessment and POA&M management for CMMC/NIST 800-171A

An ACAS/SCAP/CKL scan parser and report generator

Crane POAM Automation Tool (C-PAT™)

Comprehensive NIST SP 800-171 Rev 3 compliance toolkit: 110 control checklists, System Security Plan (SSP) templates, POA&M tracking, and CMMC Level 2 mapping. By Petronella Technology Group.

TenableTrawler (Cloud OR FedCloud) is a Python project that pulls scan results via the Tenable API, laying them into organized, POAM-ready outputs. It supports various scans and exports in formats like CSV, JSON, and YAML.

The POAM Pilot is a application designed to streamline the tracking, management, and reporting of security vulnerabilities and compliance requirements.

[Not Production Ready] This repository automates the extraction vulnerability and flaw data from vulnerability sources and then generate a Plan of Actions and Milestones (POAM), addressing identified security issues effectively.

This tool is one of eight free CMMC tools published by APT Security Management for the defense industrial base. All tools run entirely client-side with no signup and no tracking. Full list: https://github.com/Apt-Security-Management. Questions and issues welcome.

RampControl manages and tracks security compliance per FedRAMP requirements. It allows users to add new system security plans, manage POA&M entries, and export data in OSCAL format.

Focuses on automating the management of Plans of Action and Milestones (POAM) using GitHub Actions and various external integrations.

NIST SP 800-53 Rev 5 security control mapping, gap analysis, risk scoring, and POA&M development

This repository automates the collection and management of evidence from various tools and sources, committing the data for transparency and traceability. It's designed to gather evidence that tools like Vanta and others aren't built to collect.

Synthetic cybersecurity incident reporting and remediation toolkit featuring executive reports, technical timelines, root-cause analysis, lessons learned, CAPA/POA&M tracking, effectiveness validation and Excel management dashboards.

Reference implementation and control mapping for tracking CMMC Level 1-2 / NIST SP-800-171 POA&M and evidence workflows in Jira and Confluence. Independent project, not affiliated with DoD or the Cyber-AB

Synthetic cybersecurity KPI/KRI dashboard model with executive, operations and risk dashboards covering coverage, patch latency, vulnerabilities, stale assets, EDR health, DLP events, incident SLA and audit remediation metrics.

Simulated vulnerability management lab demonstrating POA&M creation, NIST 800-53 control mapping, and compliance-aligned remediation tracking for real-world vulnerabilities and cloud misconfigurations.