Federal Compliance on DefectDojo Documentation

Compliance Profile

Mon, 01 Jan 0001 00:00:00 +0000

The Compliance Profile enrolls an Asset as a system and holds the facts that appear on every deliverable it produces. Open the Asset that represents your system boundary, go to the Compliance tab, then Profile.

The POA&M Ledger

Mon, 01 Jan 0001 00:00:00 +0000

POA&M items are created and updated automatically from findings. The sync runs shortly after imports and finding changes, and a nightly sweep catches anything that slipped through. You can also add items by hand, for weaknesses that no scanner reports.

ConMon Snapshots

Mon, 01 Jan 0001 00:00:00 +0000

On the Snapshots tab, Generate Snapshot produces the deliverables for a reporting period. A snapshot freezes the ledger as of that moment: later edits never change a deliverable you have already generated.

Remediation Deadlines

Mon, 01 Jan 0001 00:00:00 +0000

Two ready-made SLA configurations ship with the feature. Assign either to your Assets from SLA configuration settings, or copy one and adjust it.

Potential Agency Impact (PAIN) Ratings

Mon, 01 Jan 0001 00:00:00 +0000

FedRAMP’s Vulnerability Detection and Response standard does not set one deadline per severity. It sets a deadline per combination of how exploitable a vulnerability is, whether it is reachable from the internet, and how much damage its exploitation would do to the agencies using your service. That third factor is the Potential Agency Impact N-rating, or PAIN.

Setting Up PAIN Ratings

Mon, 01 Jan 0001 00:00:00 +0000

Potential Agency Impact (PAIN) Ratings explains what the rating is and how a deadline is derived from it. This page is the procedure: the order to do things in, what to check at each step, and what the deadline should read when you get there.

CMMC Level 2 Assessments

Mon, 01 Jan 0001 00:00:00 +0000

The Compliance tab can score a CMMC Level 2 self-assessment against NIST 800-171 Rev 2, using the DoD Assessment Methodology point weights.

CRA and DORA Evidence Packs

Mon, 01 Jan 0001 00:00:00 +0000

DefectDojo Pro includes authored catalogs for vulnerability-related obligations in the Cyber Resilience Act (CRA) and Digital Operational Resilience Act (DORA). A regulatory assessment collects the operational facts DefectDojo already holds, gives an assessor space to document the remaining evidence, and produces a dated evidence pack. To set up an instance and your products for the CRA step by step, see Setting Up EU CRA.

Control Coverage

Mon, 01 Jan 0001 00:00:00 +0000

The control coverage view answers a simple question: which 800-53 controls do my scanners actually test, and where are the open weaknesses per control?

Setting Up EU CRA

Mon, 01 Jan 0001 00:00:00 +0000

This page takes a DefectDojo Pro instance from its first login to being ready for the EU Cyber Resilience Act (CRA): the settings to turn on once, what to record on each product in scope, what to load for each release, how to handle an Article 14 report, and how to produce evidence each period. Each step says where to click, starting from the left menu, and what you should see when it worked.