OSCAL POA&M validator.
Drop in a plan of action and milestones and find out what's wrong with it. Structure, required fields, UUID integrity, cross-references, and the FedRAMP conventions people most often miss.
Your file never leaves this page. Every check runs in your browser. There is no upload, no server, no logging, and no account. Open your network tab and watch.
Drop your OSCAL POA&M here
or click to choose a file · JSON only · nothing is uploaded
No file handy? Run it against a deliberately broken sample to see what the output looks like.
oscal-cli and the FedRAMP metaschema constraint validations, which need to run server-side against the published schemas. This tool catches the errors that account for most failed first submissions — it does not certify anything.
I do this for a living.
If the findings above are more than you want to work through, converting and validating OSCAL packages is a service I offer. Send me the errors and I'll tell you honestly how big the job is.
What it checks.
Three tiers, in the order they matter.
Structure and model
- Parses as JSON at all
- Root object is
plan-of-action-and-milestones - Required fields present on the document, metadata, and every POA&M item
- UUIDs are syntactically valid UUIDs
- Timestamps carry a timezone, as OSCAL requires
import-ssppresent with anhref
Integrity and convention
- Every referenced observation and risk actually exists in the document
- No duplicate UUIDs anywhere in the file
- Risks carry a status, and open risks carry a deadline
- Observations carry a collection method and timestamp
- POA&M items link to something — an observation or a risk
oscal-versionis a version this model recognises
Producing these by hand every cycle?
Auto-POA&M takes Nessus or STIG output and generates the POA&M for you, with the history carried forward.