How ACAS Findings Become Remediation Evidence
New to RMF? Start with What Is RMF? A Practical Introduction for SysAdmins. Most people working in federal IT environments have pulled an ACAS report before they understood what that report was actually supposed to prove. The scan runs, Tenable.sc produces a list of findings sorted by severity, and somewhere in the process that output is supposed to turn into evidence that satisfies an AO. What nobody explains upfront is what happens between the scan finishing and a finding being considered remediated inside the RMF package. ...