03.12.02 Plan of Action and Milestones

This policy outlines the requirements for developing and maintaining a comprehensive Plan of Action and Milestones (POA&M) to address identified security weaknesses, deficiencies, and vulnerabilities within our systems. The POA&M will serve as a roadmap for remediation activities, ensuring timely and effective mitigation of risks to the confidentiality, integrity, and availability of Controlled Unclassified Information (CUI).

Example POA&M Template

• A.03.12.02.a.01: a plan of action and milestones for the system is developed to document the planned remediation actions for correcting weaknesses or deficiencies noted during security assessments.
• A.03.12.02.a.02: a plan of action and milestones for the system is developed to reduce or eliminate known system vulnerabilities.
• A.03.12.02.b.01: the existing plan of action and milestones is updated based on the findings from security assessments.
• A.03.12.02.b.02: the existing plan of action and milestones is updated based on the findings from audits or reviews.
• A.03.12.02.b.03: the existing plan of action and milestones is updated based on the findings from continuous monitoring activities.