POAM Template - R3.0 changes

[bdournaee-nucleus]

Hi - I had a question about the R3.0 POAM template (Excel). I don't know if this is the correct place for this question, if not, please let me know.

We've noticed that Service Name was removed from the R3.0 version of the template, but it appeared in the R2.1 version.

We support customers who still may be using R2.1 and basically had three questions:

1. Is the official R2.1 version of the template documented anywhere for historical purposes?
2. Why was Service Name removed? We're curious about the rationale for this.
3. We just happened to notice this column had been removed. Is there a detailed change log between the R3.0 and R2.1 variations of the template other than the summary text that appears in the sheet for 11/25: _
   Added Instructions Tab, consolidated reporting fields, and simplified input requirements._

Thank you for any insight. We provide software to customers who may be relying on the older version of the template.

Blake

[mgcas-roxanne]

We have recently reviewed the POA&M Template from 2025-12-05 and also request clarification on why "Service Name" was removed when its purpose is to specify which exact service(s) are affected for each POA&M ID row?

Additionally, We have noted the following changes:

Added

• Guidance column added in column A of the "Open POA&M Items" tab.
• Li-SaaS is an option now in the impact level cell (D3) of the "Open POA&M Items" tab
• New "PL-2 Findings" tab

Changed

• DISCREPANCY: "Overall Remediation Plan" updated to "Remediation Plan" in the "Open POA&M Items" tab; however, it remained "Overall Remediation Plan" in the "Closed POA&M Items" and "Configuration Findings" tabs.

Removed from "Open POA&M Items", "Closed POA&M Items" and "Configuration Findings" tab:

• The CSP info in rows 1-3
• Planned Milestones
• Milestone Changes
• Auto-Approve
• Service Name

[pete-gov]

I'm trying to track down more info on this; the changes resulted from multiple years of feedback gathering and some of the background appears to have been lost with some of our staff. Lots of folks apparently found that column very confusing and it created more issues than it helped.

In the interim I'll say that the template contains the minimum expected information; if a cloud service provider has a good reason to include additional information then they should do so. No one should feel like removing this from the template means they aren't allowed to track and report on it if they found it useful.

[pete-gov]

Coming back on this to close this question out - this column was inadvertently added originally, did not have lots of guidance and support, and was thus removed. FR does not have any issue with folks adding it back in if a particular CSP wants to or an agency customer wants it from them.

We'll revisit the POAM fields again as part of our upcoming audit and transition to machine-readability for Rev5 materials and look to provide more instructions about optional fields.

[bdournaee-nucleus]

Hello Again - Upon reviewing the latest published template (R3.0, 11/17/2025) we've also noticed that the Planned Milestones (was column M) and Milestone Changes (was column N) no longer appear in the template. These appear to be significant changes as they remove the "Milestone" concept from the "POA&M" template - maybe I am missing something.

I'm wondering if there is any color or rationale for these changes. Thank you very much for any insight.

Blake

the link to the R3.0 template is here: https://view.officeapps.live.com/op/view.aspx?src=https%3A%2F%2Fwww.fedramp.gov%2Fresources%2Ftemplates%2FFedRAMP-POAM-Template.xlsx&wdOrigin=BROWSELINK

[paulagosta]

Blake,

The concept was not removed, just the explicit field. It was removed as we found a lot of redundancy of information between that and the remediation plan fields across the POA&Ms we examined.

If you look at the template itself, each column includes three rows: one with general guidance, one with examples, and one indicating whether the field is mandatory or situational.

In the general guidance it states "Describe the plan to resolve the weakness, especially if it cannot be fully remediated within the required timeframe. Provide enough detail to help agency customers understand the actions required, why more time is needed, and when the weakness will be fully remediated."

In the example it explicitly states milestones.

"Will be resolved during patching cycle.

OR

Migrate to new technical solution. Planned milestones are:

1. Milestone 1
2. Milestone 2
3. …..."

Hope this helps.

Pablo

[bdournaee-nucleus]

Paul - Ah thank you for this additional context and clarity.

As a follow-up question, given that R3.0 is the latest version of the template does the FedRAMP PMO archive the format of the R2.1 template anywhere for reference? I have looked and cannot seem to find it. These details are important for a software vendor (like ourselves) looking to ensure we support multiple formats as it looks like both will be use for some time. Thank you very much.

Blake