Federal Compliance on DefectDojo Documentation

Compliance Profile

Mon, 01 Jan 0001 00:00:00 +0000

The Compliance Profile enrolls an Asset as a system and holds the facts that appear on every deliverable it produces. Open the Asset that represents your system boundary, go to the Compliance tab, then Profile.

The POA&M Ledger

Mon, 01 Jan 0001 00:00:00 +0000

POA&M items are created and updated automatically from findings. The sync runs shortly after imports and finding changes, and a nightly sweep catches anything that slipped through. You can also add items by hand, for weaknesses that no scanner reports.

ConMon Snapshots

Mon, 01 Jan 0001 00:00:00 +0000

On the Snapshots tab, Generate Snapshot produces the deliverables for a reporting period. A snapshot freezes the ledger as of that moment: later edits never change a deliverable you have already generated.

Remediation Deadlines

Mon, 01 Jan 0001 00:00:00 +0000

Two ready-made SLA configurations ship with the feature. Assign either to your products from SLA configuration settings, or copy one and adjust it.

CMMC Level 2 Assessments

Mon, 01 Jan 0001 00:00:00 +0000

The Compliance tab can score a CMMC Level 2 self-assessment against NIST 800-171 Rev 2, using the DoD Assessment Methodology point weights.

Control Coverage

Mon, 01 Jan 0001 00:00:00 +0000

The control coverage view answers a simple question: which 800-53 controls do my scanners actually test, and where are the open weaknesses per control?