Generate OSCAL Exports of Vanta Issues for VantaGov Customers to Simplify Compliance Reporting

Jacob G. · 2026-09-15T15:34:09.160Z

:export-party: Generate OSCAL exports of Vanta Issues :export-party: VantaGov customers can now export Issues associated with a System directly into the OSCAL Plan of Action and Milestones (POA&M) format. This makes it easier to provide machine-readable compliance data to federal agencies and removes the need to manually convert Vanta Issues into OSCAL. :rolling-scroll: This is currently still rolling out. --- Availability: Vanta for Government customers (https://www.vanta.com/solutions/government). This is separate from customers with FedRAMP 20x.

8 comments

· Sorted by Oldest

Rob G.
·
·
hey Jacob G. this is exciting! I don't know if I have 'Vanta for government' but I do have FedRAMP 20x. Is this included with that or is that part of V4G?
👀1
Jacob G.
·
·
hold that thought, rob, good call! ill update the post too if any clarification is needed here. standby...
1
Jacob G.
·
·
hi again, rob! so these are indeed two seprate things, as far as a vanta license with fedramp20x and vanta for gov, so ultra does not have vanta for gov currently. your acct team is aware since i checked in with them, so if anything changes where your team wants to explore that further, just let me or them know, and I can make sure your team gets answers. thanks again for asking about this. sorry im not coming back with the answer you were hoping for!
Rob G.
·
·
got it thanks for the clarification Jacob. this is a perfect example of this Feature created for a specific module, but no consideration for the frameworks that may need the feature. As part of our FedRAMP 20x compliance, we use a POA&M to meet requirement VDR-CSO-FAV. The requirement doesn't specifically call out the need for a POA&M, but our auditor specifically called out needing one as corroborating evidence to show we were meeting that requirement hence us keeping a POA&M. Not to mention, we have the POA&Ms feature within the Issues module already as part of FedRAMP 20x, so it all just feels inconsistent
Jacob G.
·
·
yup, exactly 🎯 thanks, rob. and youre right. im going to ask the gov team for more context here because i too am curious about this. ill update you more here in thread
🙏🏼1
Jacob G.
·
·
hey Rob G. i spoke with the vanta for gov team about this. The POA&M OSCAL export would not be VDR/VER compliant as VDR/VER requires specific fields and information, and therefore wont meet FedRAMP 20x VDR/VER requirements. as i think about this example you bring up + the work being done in-product to make visible all SKUs on a particular license, I dont yet have word to what level of granularity that will provide. my hunch is that i would say what i did in the edit to my original message, that it is applicable for folks who have purchased vanta for gov on their licence, not fedramp 20x-only, which i imagine would be visible in the SKUs listed (showing: vanta for gov, fedramp 20x, etc). but ill confirm that once the product team gets closer to shipping that. not the answer you were hoping for, but i hope that helps provide some clarity on that front. lmk if other Qs are top of mind for you. (i learned something today too! so thanks for raising)
Rob G.
·
·
I hear ya. And fwiw our auditors accepted the POAM for some of our VDR reqs
👀1
Jacob G.
·
·
Thanks for clarifying. It sounds like your auditor accepts the POA&M as supporting evidence for some requirements, even though it may not meet every formal VDR/VER requirement on its own. That distinction is helpful, Rob. noted
👍🏼1

Rob G.
·
·
hey Jacob G. this is exciting! I don't know if I have 'Vanta for government' but I do have FedRAMP 20x. Is this included with that or is that part of V4G?
👀1
Jacob G.
·
·
hold that thought, rob, good call! ill update the post too if any clarification is needed here. standby...
1
Jacob G.
·
·
hi again, rob! so these are indeed two seprate things, as far as a vanta license with fedramp20x and vanta for gov, so ultra does not have vanta for gov currently. your acct team is aware since i checked in with them, so if anything changes where your team wants to explore that further, just let me or them know, and I can make sure your team gets answers. thanks again for asking about this. sorry im not coming back with the answer you were hoping for!
Rob G.
·
·
got it thanks for the clarification Jacob. this is a perfect example of this Feature created for a specific module, but no consideration for the frameworks that may need the feature. As part of our FedRAMP 20x compliance, we use a POA&M to meet requirement VDR-CSO-FAV. The requirement doesn't specifically call out the need for a POA&M, but our auditor specifically called out needing one as corroborating evidence to show we were meeting that requirement hence us keeping a POA&M. Not to mention, we have the POA&Ms feature within the Issues module already as part of FedRAMP 20x, so it all just feels inconsistent
Jacob G.
·
·
yup, exactly 🎯 thanks, rob. and youre right. im going to ask the gov team for more context here because i too am curious about this. ill update you more here in thread
🙏🏼1
Jacob G.
·
·
hey Rob G. i spoke with the vanta for gov team about this. The POA&M OSCAL export would not be VDR/VER compliant as VDR/VER requires specific fields and information, and therefore wont meet FedRAMP 20x VDR/VER requirements. as i think about this example you bring up + the work being done in-product to make visible all SKUs on a particular license, I dont yet have word to what level of granularity that will provide. my hunch is that i would say what i did in the edit to my original message, that it is applicable for folks who have purchased vanta for gov on their licence, not fedramp 20x-only, which i imagine would be visible in the SKUs listed (showing: vanta for gov, fedramp 20x, etc). but ill confirm that once the product team gets closer to shipping that. not the answer you were hoping for, but i hope that helps provide some clarity on that front. lmk if other Qs are top of mind for you. (i learned something today too! so thanks for raising)
Rob G.
·
·
I hear ya. And fwiw our auditors accepted the POAM for some of our VDR reqs
👀1
Jacob G.
·
·
Thanks for clarifying. It sounds like your auditor accepts the POA&M as supporting evidence for some requirements, even though it may not meet every formal VDR/VER requirement on its own. That distinction is helpful, Rob. noted
👍🏼1