So now that I'm a few months into my new job, a whole new world of activities and knowledge has been presented.  One of the things that we have on our plate is what we have been calling the Corrective Action process.

When we assess the security posture of an application, we are generally looking at NIST 800-53 security control guidelines.  After the review we create a list of vulnerabilities and then the customer can choose how to handle them.  This information generates a Plan of Action & Milestones document, which addresses the vulnerabilities and what will be done to correct them.  The Corrective Action process is how we verify that the items were handled satisfactorily.  Given the complexity of the systems we felt that it would be a good idea to design some guidelines for how to create and submit evidence for verification.  That resulted in a document called the POA&M Evidence Guidelines or PEG.  

As we drafted the guidelines, we recognized that there was no single person which would know all of the technologies avaialble.  So we are currently working on the framework and would like to seek everyone's help in filling in the information we need.  So I'm hosting that right now at peg.veeber.com as a wiki.  Once we finalize the structure we're going to open it up and hopefully we'll get some technical people to give us the commands neccessary.  So if you'd like to help, please join up and help us out.