Plan of Action and Milestones (POA&M) Management Procedure

Approval #

Revision History #

Review cycle: Every year.

Mandate. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 control CA-5 requires a plan of action and milestones for identified weaknesses. The Federal Information Security Modernization Act (FISMA), at 44 U.S.C. §3554(b)(6), requires a process to plan, carry out, evaluate, and document remedial action. The Office of Management and Budget (OMB) memorandum M-02-01 sets the POA&M format, including the fixed scheduled completion date and the record of milestone changes. This is the Organization’s POA&M procedure for every system and for the program-level POA&M.

1. Purpose and Scope #

The Information System Security Officer (ISSO) uses a POA&M item to track one weakness. The item states what is wrong, the risk it poses, the corrective action, the resources needed, the owner, and the milestones to closure. Authorizing Officials use POA&M data for risk decisions. The CISO uses it for FISMA reporting, and the Office of Inspector General uses it in its evaluations.

Each step below names the person who acts, the action, the tool, the record the step leaves, and the NIST SP 800-53 controls it supports. The ISSO keeps every POA&M item in the governance, risk, and compliance (GRC) system. Remediation work runs through change and service tickets in the ticketing system.

2. Opening a POA&M Item #

The ISSO must create a POA&M item when administrators cannot remediate a weakness at once and the weakness came from one of these sources:

1. Security control assessments, including findings in the security assessment report.
2. Vulnerability findings that will miss their due dates under the Vulnerability Management Procedure (PROC-VM-001), including vulnerabilities in the Known Exploited Vulnerabilities (KEV) catalog.
3. Audits and evaluations by the Office of Inspector General, the Government Accountability Office, and financial statement auditors.
4. Incident after-action reports.
5. Continuous monitoring results and family-policy measures that are off target.
6. Penetration tests and red team exercises.

The ISSO creates the item within 30 days of identification. For a vulnerability finding, the ISSO creates it no later than the finding’s due date.

Entry criteria: Someone identifies a weakness from one of the sources above.

Exit criteria: The weakness has an open item in the GRC system, or administrators fixed it at once.

Evidence: the assessment reports, the weekly past-due lists, the audit findings, the after-action reports, and the new items in the GRC system with their open dates.

3. Recording the Required Fields #

In each item, the ISSO records:

• A unique identifier.
• A description of the weakness, without exploitable detail.
• The source and the date identified.
• The affected systems and controls.
• A risk statement and the severity.
• The root cause of the weakness.
• The corrective action.
• The resources required, an estimated cost, and the funding status. The ISSO ties the cost to the system’s investment in the budget, by its unique investment identifier, so the cost can enter capital planning.
• The responsible point of contact.
• The scheduled completion date. Once the Authorizing Official approves the item, this date never changes.
• The milestones and their dates, and each change to a milestone with its reason.
• The status.
• The evidence of closure.

Entry criteria: The ISSO opened the item.

Exit criteria: Every required field has a value.

Evidence: the completed items in the GRC system.

4. Planning and Scheduling the Fix #

Vulnerability findings. The Vulnerability Management Procedure (PROC-VM-001) sets each vulnerability finding’s due date. The due date is the earliest of these deadlines:

• The Table 1 timeline in Cybersecurity and Infrastructure Security Agency (CISA) Binding Operational Directive (BOD) 26-04.
• The RA-5 timeframe for the finding’s severity.
• Any CISA directive deadline.

The ISSO opens the POA&M item no later than that due date. In the item, the ISSO records the interim mitigation, the earliest achievable completion date, and the Authorizing Official’s interim risk decision. Opening a POA&M item does not extend a directive deadline.

All other weaknesses. This covers assessment findings, audit findings, penetration test results, and similar weaknesses. The ISSO schedules each one from the date identified.

When an item cannot meet these timelines, the ISSO documents the reason and gets an interim risk decision from the Authorizing Official. The ISSO does not change the scheduled completion date, as OMB M-02-01 requires. The ISSO records the slip as a milestone change, with the new expected date and the reason.

Entry criteria: Every required field has a value.

Exit criteria: The Authorizing Official approved the item, and each remediation task has a ticket.

Evidence: the approved items with their scheduled completion dates and milestones, the interim mitigations and risk decisions, and the linked tickets in the ticketing system.

5. Remediating the Weakness #

Entry criteria: The item has an approved schedule and linked tickets.

Exit criteria: Every remediation ticket is closed, or the ISSO recorded a milestone change.

Evidence: the closed change and service tickets in the ticketing system, the change approvals, and the milestone change history in the GRC system.

6. Updating, Reviewing, and Reporting #

The ISSO updates the system’s POA&M items at least every month. Each quarter, the CISO’s compliance staff review all POA&Ms for quality, currency, and evidence. They produce the program-level summary that the CISO uses for the Chief Information Officer (CIO) FISMA metrics and the executive risk review. The share of past-due items is a standing program measure. The ISSO escalates missed milestones to the CISO. The CISO reports items more than 90 days past due to the Authorizing Official and adds them to the enterprise risk register.

Entry criteria: An item is open.

Exit criteria: The item is current, and the quarterly summary includes it.

Evidence: the update history of each item in the GRC system, the escalation notes, the quarterly review results and summaries, the FISMA metrics, and the enterprise risk register entries.

7. Closing an Item #

The ISSO closes an item only with evidence that the corrective action is in place and effective. The ISSO attaches the evidence to the item, such as configuration exports, rescan results that show remediation, assessor validation, or equivalent records. For an item from an audit by the Office of Inspector General, the Government Accountability Office, or a financial statement auditor, the ISSO closes the item only after the auditor agrees the weakness is fixed. The ISSO attaches the auditor’s agreement to the item. When the Authorizing Official accepts a risk in place of remediation, the Authorizing Official signs a written decision with an expiration date. The Authorizing Official reviews the decision again at each reauthorization.

Entry criteria: Every remediation ticket is closed, or the Authorizing Official decided to accept the risk.

Exit criteria: The item is closed with its evidence, or the signed risk decision is attached.

Evidence: the POA&M items in the GRC system with their milestones and closure evidence, the quarterly review results, and the Authorizing Official’s risk decisions.

8. References #

These are the sources this document cites, with a link to each official text.

• CISA Known Exploited Vulnerabilities Catalog, updated continuously.
• NIST SP 800-53 Rev. 5: Security and Privacy Controls for Information Systems and Organizations, September 2020.
• OMB M-02-01: Guidance for Preparing and Submitting Security Plans of Action and Milestones, October 17, 2001.
• OMB M-19-03: Strengthening the Cybersecurity of Federal Agencies by Enhancing the High Value Asset Program, December 26, 2018.