# Plan of Action & Milestones (POA&M) — Diskless Fleet Boot System

| Field | Value |
|---|---|
| POA&M version | 1.2 (adds P-24 / SAR F-08 — DNS/DHCP residual flows: kiosk HTTP, UKI rollback) |
| Date raised | 2026-07-10 |
| Last updated | 2026-07-11 |
| Review cadence | Monthly by System Manager; quarterly to the AO |
| Overall status | 0 of 24 items closed; P-02 engineering-complete (awaiting assessor M2) |

> **2026-07-11 remediation (`poam-hardening` branch).** The build pipeline is now
> a **fail-closed production profile** (POA&M P-03). Changes: (i) the passwordless
> debug shell was **deleted entirely** from the Packer template — no `debug_shell`
> variable, no `debug-shell.service` provisioner (P-02, R-02); (ii) `enable_stig`
> is enforced `true` by Packer **variable validation** — a build with it false
> fails `packer validate`/`build` (P-04); (iii) the CI "Production build gate"
> aborts the run unless `SB_KEY`, `SB_CERT` and `FLEET_CA` are set — no unsigned
> fallback, no placeholder RADIUS CA (P-03, P-05, P-06 CA wiring); the signed
> `fleet-ipxe` bootloader build is gated the same way. Not yet done in P-03 M1:
> `disable_dot1x=false` (blocked on P-01 secure-path bench) and distinct
> production-artifact tagging (M2). See the row-level status below.

**Severity** = assessor's pre-treatment rating. **Milestone dates** are the
assessor's recommended targets, to be confirmed by the System Owner on
appointment. Items marked **[GATE]** are conditions precedent for a production
ATO (SAR §7.2) — they cannot be risk-accepted.

---

## 1. Production-ATO gating items

| # | Weakness | Source | Severity | Remediation actions & milestones | Owner | Target | Status |
|---|---|---|---|---|---|---|---|
| P-01 **[GATE]** | Secure path (802.1X EAP-TLS + MACsec) implemented but never verified end-to-end; disabled in current builds (`disable_dot1x=true`). | R-01 | **High** | M1: complete `serving/dot1x-bench/` harness config (swtpm + hostapd + FreeRADIUS) — 2026-08-07. M2: bench pass: port `Authorized`, macsec0 addressed + DHCP, MKA survives switch-root, NVMe root over macsec0, lease renews — 2026-08-21. M3: re-enable in CI (`DISABLE_DOT1X=false`) — 2026-08-28. M4: **assessor witness** at delta assessment. | Platform team | 2026-08-28 | Open |
| P-02 **[GATE]** | Passwordless root debug shell (`debug_shell=true`) present in lab builds — undocumented privileged access path. | R-02 | **High** | M1: ~~`debug_shell=false` default + CI assertion~~ **DONE (exceeded) 2026-07-11** — the `debug_shell` variable and the `debug-shell.service` provisioner were **removed entirely** from the template; no build can bake it. M2: assessor verifies absence on the assessed digest. | Platform team | 2026-07-31 | **M1 done — awaiting assessor (M2)** |
| P-03 **[GATE]** | No enforced production build profile — security toggles (dot1x, STIG, signing, debug shell, RADIUS CA) individually settable; drift detectable only by human review. | F-01 | **High** | M1: define a CI "production" profile hard-asserting `disable_dot1x=false`, `enable_stig=true`, `debug_shell=false`, `SB_KEY`/`SB_CERT` set, non-placeholder RADIUS CA — 2026-08-14. **Partly DONE 2026-07-11:** CI "Production build gate" hard-asserts `SB_KEY`/`SB_CERT`/`FLEET_CA` (fail-closed); `enable_stig=true` enforced by template validation; `debug_shell` removed. **Still open:** `disable_dot1x=false` (blocked on P-01) + M2 distinct production-artifact tagging. | Platform team + pipeline owner | 2026-08-21 | **M1 partial** |
| P-04 **[GATE]** | STIG hardening verified but `enable_stig` was toggled off during bring-up; production CI posture unconfirmed. | R-03 | Medium | M1: ~~`ENABLE_STIG=true` in CI~~ **DONE 2026-07-11** — `enable_stig` is enforced `true` by Packer variable validation (folds into P-03); `enable_stig=false` fails the build. M2: regenerate deviations report on the assessed build; confirm 0 unjustified REVIEW rows — 2026-08-21. | Platform team | 2026-08-21 | **M1 done** |
| P-05 **[GATE]** | Boot-chain signing + Secure Boot not the standing default (unsigned/SB-off builds possible; `db` not enrolled fleet-wide). | R-13 | Low (High impact if regressed) | M1: ~~CI signing secrets permanently set~~ **DONE 2026-07-11** — the CI Production build gate fails closed without `SB_KEY`/`SB_CERT`; no unsigned-UKI fallback remains (the signed `fleet-ipxe` build is gated too). M2: `db` enrolled on all production hosts via `fleet-sb-enroll`; enrolment recorded per host — 2026-09-11. M3: assessor spot-checks `mokutil --sb-state` + `sbverify` — delta assessment. | Platform team | 2026-09-11 | **M1 done** |
| P-06 **[GATE]** | Placeholder RADIUS CA — real EAP-TLS trust anchor not provisioned. | R-08 | Medium | M1: provision environment RADIUS CA out-of-band (classification permitting, not committed) — 2026-08-07 (pre-req for P-01 M2). | Environment owner | 2026-08-07 | Open |
| P-07 **[GATE]** | Governance layer absent: AO/System Owner/CISO unappointed; data classification unconfirmed; documentation unapproved. | SAR §1.4, §2.4.2 | **High** (blocks ATO structurally) | M1: appoint AO, System Owner, CISO — 2026-08-14. M2: System Owner confirms data classification; re-baseline SSP if above STARFLEET RESTRICTED — 2026-08-28. M3: AO approves documentation set — with ATO decision. | Organisation / System Owner | 2026-08-28 | Open |
| P-08 **[GATE]** | No Incident Response Plan, continuous-monitoring plan, or log-retention policy; volatile RAM overlay complicates forensics (no break-glass procedure). | R-12 | Medium | M1: author IRP incl. stateless-host forensics (capture-before-reboot guidance, collector/SIEM as evidence store) — 2026-09-04. M2: continuous-monitoring plan + log-retention policy — 2026-09-04. M3: tabletop exercise of the IRP — 2026-09-25. | SecOps | 2026-09-25 | Open |
| P-09 **[GATE]** | Audit-log offload plaintext on both hops (host→collector, collector→Wazuh); retention/archival unconfigured; Wazuh default credentials; dashboard/API unrestricted. | R-07 | Low–Medium | M1: rsyslog TLS (gtls/6514, fleet CA) host→collector; re-select the 3 waived `rsyslog_encrypt_offload_*` STIG rules — 2026-09-04 (also closes the DNS-spoofable audit-stream flow — F-08/P-24). M2: TLS collector→Wazuh — 2026-09-04. M3: rotate Wazuh credentials, restrict dashboard/API, set allowed-ips — 2026-08-21. M4: configure retention/archival per policy from P-08 — 2026-09-18. | Platform / SecOps | 2026-09-18 | Open |
| P-10 **[GATE]** | ISM control identifiers unreconciled against the May 2026 ISM release (representative numbering throughout Annex A). | SAR §2.4.1 (P-17 in SAR text) | Medium (assurance) | M1: reconcile all `ISM-NNNN*`; map any new May-2026 controls; disposition retired ones — 2026-08-21 (assessor task, System Owner to facilitate). | IRAP assessor + System Owner | 2026-08-21 | Open |
| P-11 **[GATE]** | Management/enrolment plane (fleet-manager, broker, step-ca fleet CA, InfluxDB) is an unauthorised connected system the host now trusts; fleet CA key protection unassessed. | R-14 | Medium | M1: author management-plane SSP (CA key protection, broker hardening incl. F-04 abuse controls, InfluxDB token/data, admin-plane exposure) — 2026-09-11. M2: separate assessment/authorisation or AO interim risk position covering the fleet CA — 2026-10-02. | Platform / SecOps | 2026-10-02 | Open |

## 2. Risk-acceptance candidates (production at STARFLEET ROUTINE, isolated LAN) — treat on roadmap

| # | Weakness | Source | Severity | Remediation actions & milestones | Owner | Target | Status |
|---|---|---|---|---|---|---|---|
| P-12 | NVMe/TCP root traffic plaintext on the LAN. | R-04 | Medium | M1: document transport decision (TLS/IPsec vs MACsec end-to-end across fabric) — 2026-09-25. M2: implement chosen transport protection — 2026-11-27. Interim: isolated LAN + dm-verity integrity accepted. | Platform / network | 2026-11-27 | Open |
| P-13 | Host admin access: NOPASSWD, fleet-generic, non-rotatable key; no human MFA on host SSH. | R-05 | Medium | M1: design per-host/rotatable access (SSH CA `TrustedUserCAKeys` or config agent) — 2026-10-16. M2: implement + bench under `staff_u` confinement — 2026-11-27. | Platform team | 2026-11-27 | Open |
| P-14 | AACA/AACP conformance not asserted; FIPS off; crypto-module evaluation unconfirmed. **Escalates to blocking if classification > STARFLEET RESTRICTED (P-07 M2).** | R-06 | Medium | M1: AACA/AACP conformance statement for EAP-TLS, MACsec-GCM, mTLS, SSH suites — 2026-09-25. M2: FIPS/evaluated-module decision alongside signing posture — 2026-10-30. | Security + platform | 2026-10-30 | Open |
| P-15 | Host firewall (firewalld) disabled on the workstation. | R-09 | Low–Medium | M1 (after P-01): re-enable with explicit allows (NVMe/TCP 4420, DHCP, log offload 6514, SSH; reciprocal egress rules) + bench NVMe/NM stability — 2026-09-25. | Platform / network | 2026-09-25 | Open |
| P-16 | Patch cadence / critical-CVE SLA undefined for the rebuild-redeploy model. | R-10 | Medium | M1: define cadence + CVE SLA — 2026-08-28. M2: automate rebuild triggers on upstream advisories — 2026-10-30. | Platform team | 2026-10-30 | Open |
| P-17 | SSH host keys regenerate every boot — admin connections are perpetual TOFU; LAN MITM undetectable client-side. | **F-02 (new — add to Annex A register)** | Medium | M1: add to risk register — 2026-07-24. M2: ~~stable TPM-derived host keys or SSH host CA~~ **IMPLEMENTED 2026-07-11 (`poam-hardening`)** — the **SSH host CA** path (Design A, broker-mediated): `fleet-ssh-hostcert` (files/ssh-hostcert) gets each host's per-boot key signed by the fleet SSH CA **via the enrol-broker host plane** (TPM-identity mTLS) at boot; admins trust via one `@cert-authority` line. Keeps step-ca behind the single front door. **BENCH-VERIFY** the broker↔step-ca SSH-CA contract + principal policy + SELinux (docs/ssh-host-certificate-design.md). M3: bench-verify end-to-end on a booted+enrolled host; roll the `@cert-authority` anchor to admins — 2026-10-16. | Platform team | 2026-10-16 | **M2 implemented — bench-verify (M3)** |
| P-18 | Time source unauthenticated (DHCP-handed NTP, no NTS) — host clock is an input to all certificate validation. | **F-03 (new — add to register)** | Low–Medium | M1: add to register — 2026-07-24. M2: ~~NTS or keyed NTP~~ **IMPLEMENTED 2026-07-11 (`secure-ntp`)** — **NTS (RFC 8915)**: the serving NTP server's NTS-KE TLS cert is fleet-CA-signed; the host (`secure_ntp=true`) verifies it against `radius-ca.pem` and syncs authenticated time. The server name is **derived at runtime from the DHCP domain** (`ntp.<domain>`) — no baked FQDN, so a site-domain change needs no rebuild. A DHCP/DNS spoofer can only DoS, not shift the clock. **BENCH-VERIFY** `chronyc authdata` NTS cookies + DHCP option-15 domain handout + tcp/4460 + STIG chrony (docs/secure-ntp-design.md). M3: bench-verify end-to-end; issue the NTS server cert per environment — 2026-10-30. | Platform team | 2026-10-30 | **M2 implemented — bench-verify (M3)** |
| P-19 | Fleet-wide availability SPOF: single unreplicated NVMe/TCP root target. | **F-05 (new — add to register)** | Medium (availability) | M1: interim `ctrl_loss_tmo`/`reconnect_delay` tuning at connect time — 2026-08-28. M2: multipath/ANA replica design (byte-identical same-UUID namespaces, multi-path discovery) — 2026-11-27. M3: document fleet RTO in IRP (P-08). | Platform team | 2026-11-27 | Open |
| P-20 | No remote attestation of TPM boot measurements (compromised boot not centrally detectable). | R-11 | Low–Medium | M1: design TPM quote → verifier flow (candidate: extend fleet-agent/manager, gated on P-11 authorisation) — 2027 roadmap. Interim compensation: SB + signed UKI + dm-verity + F-07 posture telemetry. | Platform team | 2027-Q1 | Open |
| P-21 | Runtime posture drift not fully monitored (SB state, fapolicyd enforcement, cmdline hash not in telemetry). | **F-07 (new)** | Low | M1: extend fleet-agent facts + manager drift alerts — 2026-09-25 (pairs with P-05 M2). | Platform team | 2026-09-25 | Open |
| P-22 | Cross-protocol TPM key reuse ("one identity, three stages") — domain-separation analysis and revocation blast-radius plan undocumented. | **F-06 (observation)** | Low | M1: add a short analysis + revocation procedure to the SSP — 2026-08-28. | Platform + security | 2026-08-28 | Open |
| P-23 | Agent reconcile actuators deferred; enabling them creates a remote host-mutation channel outside this assessment's scope. | R-15 | Low (v1) | Standing condition, not a dated milestone: **delta assessment of the command/authZ path required before any actuator is enabled** (SAR §7.3 revocation trigger). Keep behind an explicit build flag. | Platform team | At actuator build | Open (condition) |
| P-24 | DNS/DHCP untrusted-input pattern undocumented, and two flows escape it: **kiosk content over plain HTTP** (DNS/DHCP spoof → attacker page fullscreen on every workstation; Chromium PNA allowance to the loopback host-info agent reachable from it) and **UKI rollback** (a spoofer can serve an older, still-validly-signed UKI — Secure Boot does not prevent this). The plaintext audit offload was the third such flow; it is closed by P-09 M1 (cross-ref). DNSSEC/DoT is explicitly **not** the treatment — authenticate above resolution, per the system's own pattern. | **F-08 (new — add to register)** | Medium | M1: add F-08 to the Annex A register + state the "DNS/DHCP are untrusted; every security-relevant connection authenticates its peer above name resolution" principle in the SSP — 2026-08-14. M2: serve the kiosk over **TLS with a fleet-CA-signed cert** (serving nginx/kiosk proxy; pin the fleet CA via Chromium enterprise policy; kiosk URL → `https://`) — 2026-09-25. M3: record the UKI-rollback residual against R-13 and document the anti-rollback design decision (dbx revocation / TPM monotonic counter, design v2 §6) — 2026-11-27. | Platform team | 2026-11-27 | Open |

## 3. Milestone timeline (summary)

```
2026-07  P-02 debug shell off ── P-17/P-18 register updates
2026-08  P-06 RADIUS CA ── P-01 secure-path bench ── P-03/P-04/P-05 prod profile+signing
         P-07 roles+classification ── P-10 ISM reconciliation ── P-16 patch SLA ── P-22
         P-24 register+SSP DNS principle
2026-09  P-08 IRP/monitoring ── P-09 log TLS+retention ── P-11 mgmt-plane SSP
         P-15 firewall ── P-21 posture telemetry ── P-12/P-14 decisions ── P-24 kiosk TLS
2026-10  P-11 mgmt-plane authorisation ── P-13/P-17 access model ── P-14/P-18 crypto/NTS
         ── DELTA ASSESSMENT + production ATO decision window
2026-11  P-12 storage transport ── P-13 rotatable access ── P-19 multipath
         P-24 anti-rollback decision
2027-Q1  P-20 remote attestation
```

**Earliest realistic production-ATO decision: mid-October 2026**, contingent on
the delta assessment witnessing P-01 through P-11 closed.

---

*End of POA&M. Maintain alongside [TODO.md](TODO.md); update item status at
each monthly review and re-issue to the AO quarterly or on material change.*