I am tasked with creating a POAM for our monthly FedRAMP CVE scans. We are running container images on EKS.

If the same CVE shows up in multiple container images do I need to enter it once or for every distinct container image that gets flagged?

Also, does anybody know how to find out what the corresponding NIST 800-53 control is for a CVE? I checked the NVD CVE JSON API and they provide the CWE but not control