Determine method to map results to GSA security policies, guidelines, and SOPs

[ohsh6o]

As a cloud.gov application developer, to understand why I want more actionable vulnerability information about my dependency upgrades and how to leverage that in my own app's ATO process for the parts for which I am responsible, I would like to know how effectively managing dependency upgrades using this proof-of-concept maps to our compliance or non-compliance on specific security controls.