Federal compliance
DefectDojo Pro can run the vulnerability management side of a federal compliance program. It keeps a FedRAMP-style Plan of Action and Milestones (POA&M) for each system, produces monthly Continuous Monitoring (ConMon) deliverables in the official Excel and OSCAL formats, scores CMMC Level 2 self-assessments, and shows which NIST 800-53 controls your scanners actually exercise.
Everything described in this section lives on the Compliance tab of an Asset.
Enabling the feature
Federal Compliance ships behind the Compliance feature flag, which is in beta and off by default. An administrator turns it on from Settings > Feature Flags — see Feature Flags. Once enabled, a Compliance tab appears on each Asset.
Beta: confirm results before you rely on them
This feature is in beta. The bundled NIST 800-171 and 800-53 control statements, the DoD SPRS point weights, and the POA&M-eligibility rules are provided to help you track and estimate your posture, and are pending independent validation against the authoritative source documents.
SPRS scores, conditional-eligibility results, and control coverage are advisory. Confirm them against the official DoD NIST SP 800-171 Assessment Methodology and current FedRAMP guidance before you rely on them for a certification, an assessment submission, or any contractual purpose.
In this section
| Page | What it covers |
|---|---|
| Compliance Profile | Enrolling an Asset as a system and setting the facts that appear on every deliverable |
| The POA&M Ledger | How POA&M items are created from findings, and the conventions the ledger follows |
| ConMon Snapshots | Monthly deliverables in FedRAMP Excel and OSCAL, and the optional OSCAL validation service |
| Remediation Deadlines | The FedRAMP Rev 5 and FedRAMP VDR SLA presets |
| Potential Agency Impact (PAIN) Ratings | Rating findings on FedRAMP’s N-scale, and the Class C deadline matrix |
| Setting Up PAIN Ratings | A step-by-step walkthrough: turn tiering on, assign a rating, and check the deadlines against the matrix |
| CMMC Level 2 Assessments | Scoring a self-assessment against NIST 800-171 Rev 2 |
| CRA and DORA Evidence Packs | Assessing an Asset against authored EU regulatory catalogs and exporting its evidence |
| Setting Up EU CRA | A step-by-step walkthrough: turn the features on, record each product’s CRA facts, load releases, handle an Article 14 report, and produce evidence |
| Regulatory Profile | Recording an Asset’s CRA, DORA and NIS2 facts: critical or important function, CRA product class, support period, and vulnerability report contacts |
| Control Coverage | Which 800-53 controls your scanners test, and open weaknesses per control |
| Certification Control Catalogs | Assessing an Asset against ISO/IEC 27001, SOC 2 and NIS2, and the cross-framework Shared Evidence view |
Assess an Asset against ISO/IEC 27001:2022 Annex A, the SOC 2 Trust Services Criteria and the NIS2 technical requirements, and see one body of evidence answer all three
Score a self-assessment against NIST 800-171 Rev 2
Enroll an Asset as a system and set the facts that appear on every deliverable
Monthly deliverables in FedRAMP Excel and OSCAL, and the optional OSCAL validation service
Which 800-53 controls your scanners test, and open weaknesses per control
Assess an Asset against authored EU regulatory catalogs and export its evidence
Track the 24 hour, 72 hour and final report deadlines the Cyber Resilience Act sets for an actively exploited vulnerability or a severe incident
Record a cyber device profile, track the section 524B lifecycle metrics, and export the evidence pack an assessor reviews
Assess a cardholder data environment against the PCI DSS vulnerability management requirements and export the workbook an assessor reviews
Rate findings on FedRAMP's N-scale and drive remediation deadlines from the Class C matrix
Record the CRA, DORA and NIS2 facts for an Asset: critical or important function, CRA product class, support period, and where vulnerability reports go
The FedRAMP Rev 5 and FedRAMP VDR SLA presets
Configure DefectDojo Pro and your products for Cyber Resilience Act vulnerability handling, Article 14 reporting and evidence packs
Turn on PAIN tiering, assign a first rating, and verify the deadlines the Class C matrix predicts
How POA&M items are created from findings, and the conventions the ledger follows