GRC POA&M lifecycle diagram
Use this skill to structure the GRC content and visual pattern for POA&M items, audit findings, remediation milestones, validation, closure, and escalation paths. Then use the drawio skill to generate the native editable .drawio file and optional PNG/SVG/PDF export.
Common Requests
- FedRAMP POA&M lifecycle
- audit finding remediation
- vulnerability exception to POA&M
- corrective action tracking
Recommended Elements
Include these when relevant:
- finding
- POA&M item
- owner
- severity
- milestone
- due date
- validation
- closure
- risk acceptance
Recommended Output Pattern
Produce a State machine, remediation workflow, or milestone timeline. Choose a layout that matches the audience:
- Executive: compact lifecycle/capability view with business impact labels.
- Auditor/assessor: explicit evidence, owner, control, cadence, and scope labels.
- Practitioner/engineering: operational systems, data paths, automation, failure/exception paths, and implementation detail.
draw.io Instructions
- Load and follow the
drawio skill.
- Generate native mxGraphModel XML directly. Do not generate Mermaid as the final artifact.
- Use descriptive lowercase hyphenated filenames.
- Include a legend when colors, edge styles, or containers have compliance meaning.
- Validate XML well-formedness before finalizing.
- If PNG/SVG/PDF is requested, export with embedded diagram XML when the draw.io CLI is available.
Visual Conventions
- Blue: systems, platforms, services, and automated collectors.
- Green: implemented controls, approvals, validated evidence, and compliant outcomes.
- Orange/red: risks, findings, exceptions, overdue items, gaps, and failed controls.
- Gray: manual tasks, external parties, optional steps, and out-of-scope areas.
- Dashed containers: audit scope, trust boundaries, authorization boundary, or responsibility boundary.
- Solid edges: primary process or system flow.
- Dashed edges: evidence or attestation flow.
- Dotted edges: optional, manual, exception, or escalation flow.
Quality Bar
- Make ownership explicit.
- Label regulated data, control IDs, frameworks, and evidence repositories when known.
- Show decision criteria where the process branches.
- Avoid generic boxes like "Compliance" without a role, system, artifact, or action.
- Prefer editable source of truth over screenshots.
1---2name: grc-poam-diagram3description: Use when creating a draw.io diagram for POA&M items, audit findings, remediation milestones, validation, closure, and escalation paths in a GRC, security, audit, compliance, privacy, cloud, or risk context.4---56# GRC POA&M lifecycle diagram78Use this skill to structure the GRC content and visual pattern for POA&M items, audit findings, remediation milestones, validation, closure, and escalation paths. Then use the `drawio` skill to generate the native editable `.drawio` file and optional PNG/SVG/PDF export.910## Common Requests1112- FedRAMP POA&M lifecycle13- audit finding remediation14- vulnerability exception to POA&M15- corrective action tracking1617## Recommended Elements1819Include these when relevant:2021- finding22- POA&M item23- owner24- severity25- milestone26- due date27- validation28- closure29- risk acceptance3031## Recommended Output Pattern3233Produce a State machine, remediation workflow, or milestone timeline. Choose a layout that matches the audience:3435- Executive: compact lifecycle/capability view with business impact labels.36- Auditor/assessor: explicit evidence, owner, control, cadence, and scope labels.37- Practitioner/engineering: operational systems, data paths, automation, failure/exception paths, and implementation detail.3839## draw.io Instructions40411. Load and follow the `drawio` skill.422. Generate native mxGraphModel XML directly. Do not generate Mermaid as the final artifact.433. Use descriptive lowercase hyphenated filenames.444. Include a legend when colors, edge styles, or containers have compliance meaning.455. Validate XML well-formedness before finalizing.466. If PNG/SVG/PDF is requested, export with embedded diagram XML when the draw.io CLI is available.4748## Visual Conventions4950- Blue: systems, platforms, services, and automated collectors.51- Green: implemented controls, approvals, validated evidence, and compliant outcomes.52- Orange/red: risks, findings, exceptions, overdue items, gaps, and failed controls.53- Gray: manual tasks, external parties, optional steps, and out-of-scope areas.54- Dashed containers: audit scope, trust boundaries, authorization boundary, or responsibility boundary.55- Solid edges: primary process or system flow.56- Dashed edges: evidence or attestation flow.57- Dotted edges: optional, manual, exception, or escalation flow.5859## Quality Bar6061- Make ownership explicit.62- Label regulated data, control IDs, frameworks, and evidence repositories when known.63- Show decision criteria where the process branches.64- Avoid generic boxes like "Compliance" without a role, system, artifact, or action.65- Prefer editable source of truth over screenshots.
grcengclub