Skip to content
Daniel TorresConnect

Case study 03 · Risk Assessment Report Engine

RARE

One POA&M export in. A leadership-ready DoD risk assessment report out.

Single offline file · prepared for team release

Film shows RARE processing a synthetic 61-item POA&M with placeholder names.

01Program challenge

Building a Risk Assessment Report from a POA&M meant counting raw and residual risk by source, checking every likelihood and residual risk value against the assessment matrices, and retyping system details into the report template.

The RAR is what an authorizing official reads to accept risk. Counting errors or scores that disagree with the matrix undermine the decision it supports.

02Leadership decision

Requirements
Mapped every RAR field to its POA&M source and documented the NIST SP 800-30 derivations behind each computed value.
Stakeholders
Authorizing officials and security managers read the output; assessors and ISSOs produce it.
Trade-off
Kept AI in a separate, optional step on approved platforms rather than inside the tool, so the core report needs no model and no network.

Key decisions

Two matrices, two authorities

The likelihood table follows DoD convention and the risk table follows NIST SP 800-30 Table I-3. They are identical today and kept separate on purpose, so either can change without breaking the other.

Rules for relevance of threat

Technical STIG and ACAS findings are treated as adversarial at high relevance. Non-technical control findings take relevance from the system’s confidentiality, integrity and availability high-water mark.

Flag, don’t overwrite

POA&M values are exported as recorded and mismatches are highlighted, so the risk owner makes the call.

Stay reviewable

Headers are located by name to survive template revisions, and the tool remains one local file with no build tooling so engineers can audit it.

03Engineering solution

  • Imports the eMASS POA&M export and filters by status, with Ongoing and Risk Accepted included by default.
  • Pre-fills the executive summary fields from the export header.
  • Summarizes raw and proposed residual risk by level for NIST 800-53, STIG and ACAS findings.
  • Flags every finding whose likelihood or residual risk disagrees with the matrices, and generates the two-sheet RAR workbook.
  • Packages findings and a standing prompt for drafting the executive summary on an approved AI platform, with a reminder of which platforms are authorized.
  1. Step 1

    Import the POA&M export

  2. Step 2

    Confirm statuses and system details

  3. Step 3

    Review raw versus residual risk and matrix flags

  4. Step 4

    Generate the RAR workbook and findings package

04Operational impact

A complete RAR workbook with an executive summary sheet and a color-coded findings sheet, built from the export instead of retyped.

Matrix disagreements are surfaced before the report reaches the authorizing official.

Organized and documented the source so engineers reviewing it before team release can follow every derivation.