ATO renewal was blocked by CVE-driven POA&M volume in a decentralized, intermittently maintained system. We restructured mitigations into validated vulnerability classes that the SCA and AO accepted