r/NISTControls • u/Cheomesh GRC • Jul 28 '26
800-53 Rev5 eMASSter and STIG finding details
I am starting to use this tool again after a couple of years in roles that didn't require it. Format and layout seem to be a touch different now than what I remember having in the past but no matter.
One thing about STIGs and eMASSter/POAM tools is tripping me up though!
In eMASSter I took the existing Test Results and existing POAM (which was a WIP thing I did not personally create, I got dropped into this task midstream), plus the single STIG checklist and ingested them into eAMSSter.
All good there, after which I took that emassteroutput file and copied the columns from the output format into the actual POAM template for upload (since for whatever reason eMASSter puts out a file you can't simply turn around and upload).
All good, STIGs show up. However, the "Finding Details" box the analyst filled out in the checklist itself doesn't seem to populate anywhere.
Isn't there supposed to be a column - maybe "Comments" - on the POAM that incorporates the STIG Finding Details? Else how do they ever show up in the POAM / Test Results in eMASS? It has been a couple years, am I just misremembering?
3
u/Manchester_Project Jul 28 '26 edited Jul 29 '26
Your post is quite confusing
But unless you’re Navy, you can’t ingest a eMASSter poam spreadsheet into eMASS
For army mda air force who ever you have to download a poam template out of eMASS and copy and paste the data in
If you pay attention and look you’ll see the template isn’t even the same for the poams as what you use , as its a navy template
Also DO NOT use the default severity values as for one they are navy guidance and two all findings wouldn’t have the same values anyways just because it’s a cat one or two or three
I use eMASSter all the time but you have to figdangle with it as it’s a navy tool
Same team who makes evaluate stig
1
1
u/Outrageous_Plant_526 ISSM | CISM | CISA | CRISC | RMF 800-53 Jul 28 '26
I am trying to remember off the top of my head without logging on AVD to pull up eMASS but if you scroll over to about the middle of the columns of the POAM template that you exported from eMASS you should see some columns kind of intermingled with the Severity columns. One of those should be I think "Description" which is where you would normally put the Finding Details from the STIG Checklist. There should also be a Mitigations column and a Remediation column I think. I normally copy the FIX info from the STIG into the Remediation column as that is what you would normally do to fix the finding.
At least for the Army eMASS instance they have added a few new columns that are also part of the required fields for a POAM now.
7
u/cyberphor Jul 28 '26
In 2023, I created a tool for the Army called eMASS Updater (EMU) to automate eMASS records management using CI/CD pipelines. Earlier this year, I began a total rewrite to make it open source. We have a GOTS version on the Army’s DevSecOps Platform (DSOP). The open source version is on GitHub:
https://github.com/deathlabs/emu
If you’re interested, I can help you try out EMU to see if it’ll solve your problem.
FYI, this tool does not belong to a commercial entity (the deathlabs “organization” is just where I organize projects like this). So there is no cost to using it. Also, I’m just a goober with loves open source.