RMFInsider

A finding is worth disputing when the assessor tested the wrong thing: wrong scope, wrong applicability, a control you inherit, evidence that sat in the artifact folder and never got opened, or a benchmark version that was superseded before the assessment started. Everything else belongs in a POA&M. The rebuttal that works is one page. Name the control and the assessment procedure, quote the determination statement that was scored, attach the specific evidence with a file name and a page reference, and state the compliance status you are asking for. Send it while the assessment is still open if you possibly can, because once the report is signed you are asking a government official to reissue a signed document instead of asking an assessor to fix a worksheet.

Seven grounds that actually hold up

Every dispute I have seen succeed came down to a factual error in what was tested, not a difference of opinion about how bad the weakness is. If your rebuttal cannot be reduced to one of these, you are writing a complaint.

• Wrong scope. The host, database or enclave that got scanned is not inside the authorization boundary shown on the approved boundary diagram, or it belongs to a different package with its own authorization.
• Wrong applicability. The control or CCI is not in your selected baseline, it was tailored out with documented AO concurrence, or the Not Applicable condition is met on its face (a wireless requirement on a system with no wireless capability, a mobile code requirement on a system that runs none).
• The control is inherited. The requirement is satisfied by a common control provider or the hosting environment, and the finding belongs on their package. Inheritance only helps if the relationship was documented before the assessment, which is why setting up control inheritance early pays off twice.
• Evidence was never reviewed. The artifact existed, it was uploaded before the evidence cutoff date in the assessment plan, and the test result narrative describes something else. This is the cleanest dispute there is, and also the one that requires you to have dated upload records.
• Wrong baseline. You were assessed against a higher impact level than your categorization supports, or against a control enhancement that is not in your baseline at all. Check the categorization record before you assert this, because the assessor may be reading a newer one than you are.
• Superseded benchmark version. The STIG or SRG revision used for the check was not the revision in effect under the assessment plan. Version currency rules vary by component, so cite the plan rather than arguing from the release date.
• The determination statement does not say that. The assessor scored an objective the assessment procedure does not contain. Rare, and worth raising politely, because the procedure text is the thing both of you are bound by.

When you are not disputing, you are just unhappy

The other category is real and it is larger. You think the severity is too high. The finding makes the program look bad in front of the government lead. The fix costs money nobody budgeted. You have a compensating control you believe covers the risk. None of those are grounds to change the compliance status, and pushing them as if they were is how you spend the credibility you will need later in the same assessment.

Disagreeing with a CAT I on a system that has run exactly that way for six years is a feeling, not a rebuttal. Compensating controls and mitigating factors do belong in the package, just not here: they go in the residual risk discussion and in the risk assessment narrative, where the authorizing official can weigh them. The assessor’s job is to state whether the control is satisfied as written. Your job is to make sure the risk story around an unsatisfied control is accurate.

The window matters more than the argument

The same facts get a different result depending on when you raise them. I have had a finding reversed in forty minutes during an assessment and watched the identical issue take five weeks after the report went out.

While the assessment is open

During test execution there is usually a daily or end-of-week hot wash and a draft findings worksheet. That worksheet is working paper, not a signed product, and assessors change entries on it routinely. Ask for the draft in writing, read the test result narrative for each open item, and return your corrections inside the turnaround the assessor asks for, which in my experience runs twenty-four to seventy-two hours. This is the cheapest correction available and it costs the assessor nothing but a keystroke. Knowing what assessors actually test in the Assess step ahead of time is what lets you spot the wrong-scope finding on day two rather than at the out-brief.

After the report is issued

Once the security assessment report is signed it becomes an official record that feeds the authorization decision, and changing it means an addendum, an errata memo or a reissued report from the assessment organization. That is a government signature, so the request routes through your ISSM and the assessor’s chain rather than a direct email, and the turnaround is measured in weeks. Do it anyway when the finding is factually wrong, because a wrong finding you accept quietly follows the system into the next reauthorization and into every reciprocity conversation you have.

The one-page rebuttal

Format is the whole game. Assessors read these between test sessions, and a rebuttal that forces someone to reconstruct your reasoning gets deferred. I keep each one to a single page, one finding per page, and I never mix two findings into one memo.

• Identifiers first. System name and acronym, package identifier, finding or vulnerability ID, control ID with enhancement, and the CCI. If your component tracks findings by test results and CCIs in eMASS, use the same identifiers the tool uses so nobody has to translate.
• The requested change in one sentence. “Request compliance status change from Non-Compliant to Not Applicable for CCI-000213 on this asset.” State it before you explain it.
• The control text and the assessment procedure. Quote the determination statement that was scored, not a paraphrase. Half of these disputes resolve themselves the moment both parties read the same sentence.
• The ground, named. One clause: scope, applicability, inheritance, evidence not reviewed, baseline, or version. Pick one. A rebuttal that offers three reasons reads like none of them are strong.
• The evidence, located. File name exactly as it appears in the artifact list, upload date, and the page, section, line number or screenshot label that answers the determination statement. Do not attach a forty-page document and hope.
• What you are not disputing. Listing the findings you accept tells the assessor you read the whole report and are not running a blanket objection.
• Name, role, date, and the ISSM on copy. The ISSM has to know what is being contested in their own package.

Dispute, or accept it and write the POA&M

These are different paths with different clocks. A successful dispute removes the finding from the report and it never becomes a plan of action item. Acceptance means you write the item, set a scheduled completion date, identify resources and milestones, and carry it into continuous monitoring until it closes. The trap is treating the dispute as a delay tactic, because a dispute that fails after three weeks has burned three weeks of remediation time and you still owe the same milestone dates.

What I do now is run both in parallel. Draft the POA&M entry the day the finding appears, keep it unsubmitted, and file the rebuttal at the same time. If the dispute lands, delete the draft. If it does not, the item goes in on schedule and the assessor’s decision did not cost you a milestone. This also changes your tone for the better, because you are no longer arguing as though the dispute is your only exit.

Escalation, in order, with a pause at each level

Skipping a level is the fastest way to turn a technical disagreement into a personnel problem. The order is the assessor who wrote the finding, then the assessment lead or SCA representative, then your ISSM, then the AO staff or the assessment organization’s leadership. Give each level a real chance and a stated deadline before you move up, and tell the person you are escalating past that you are doing it. Nobody involved enjoys learning about a disagreement from a message that was already sent to their boss.

Two practical notes. First, escalation above the assessment lead is your ISSM’s call, not yours, and in DoD packages it usually travels as an ISSM memo rather than an ISSO email. Second, the number of findings you escalate per assessment should be countable on one hand. An assessment where you contest fifteen items is not an assessment problem, it is a package readiness problem, and everyone in the room can see that.

The tone that gets a finding reversed

Assessors reverse findings when reversing is defensible, not when the requester is persuasive. So write for the file, not for the argument. Cite, do not characterize. Drop every adjective: “incorrect” is not needed if you have shown the asset is out of boundary. Ask a question when you genuinely do not understand what was tested, because “can you tell me which host this check ran against” resolves scope disputes without anyone having to be wrong in writing.

Concede early and specifically. An opening line that accepts the nine findings you deserve makes the tenth one readable. Answer within the assessor’s timeline even when your answer is “we accept this and will POA&M it.” And keep the relationship in mind past this package: the same three or four validators will assess your systems for years, and the ISSOs they answer quickly are the ones who send short, sourced, accurate email.

After the decision

If the finding changes, get the change reflected in the record rather than in an email thread. The test result and compliance status in the tool, the report addendum, and your own artifact index should all agree before the package moves to the authorization decision. If the finding stands, close the loop in one line, accept it, and move it into the plan of action with a date you can actually hit. Track the item from there like any other open finding, because the assessment ends and the monitoring does not. If you want the tracker I use for scheduled completion dates, milestones and closure evidence, it is in the POA&M Tracker.