What Is a Plan of Action and Milestones (POA&M)?

Your assessment is done and weaknesses remain. You need the system to go live. The POA&M is the document that bridges those two facts.

The definition

POA&M stands for Plan of Action and Milestones. It is the formal record of every known security weakness in a system and the plan to fix each one. Each entry names the weakness, the corrective actions, and the person responsible. It also lists the resources needed and the date the fix will be done.

The POA&M is part of the authorization package in the Risk Management Framework. RMF is the Risk Management Framework. It is the seven-step federal process for authorizing systems, described in NIST SP 800-37 Revision 2. The package goes to the authorizing official, who decides whether the system may operate (NIST SP 800-37 Revision 2).

The authorizing official is the senior leader who accepts the risk. They read the assessment results, then read the POA&M. The POA&M shows them that each weakness has an owner, a plan, and a date. Without it, remaining weaknesses are just findings. With it, they are managed risk.

What each entry must contain

Weakness description. State exactly what is wrong, in plain terms. "Logging is not centralized" works. "Deficiencies exist in the audit capability" does not.

Affected controls. Name the security control or controls the weakness touches. Controls come from NIST SP 800-53 Revision 5, the federal control catalog (NIST SP 800-53 Revision 5).

Risk level. State the severity if the weakness is exploited. Risk comes from the likelihood of the problem being used and the harm it would cause. High risk weaknesses get earlier dates.

Planned corrective actions. List the concrete steps that close the weakness. "Enable centralized logging for all production systems" is a step. "Improve logging" is a wish.

Milestones with dates. Break each fix into checkpoints with scheduled completion dates. One final date with no milestones hides slippage until it is too late.

Responsible person. Name the human who owns the fix. "The security team" is nobody. A named owner answers for the date.

Resources required. State what the fix needs: staff time, budget, licenses, or vendor work. A plan with no resources is a plan that cannot execute.

How the authorizing official uses it

The authorizing official grants an Authorization to Operate based on the full package. ATO means Authorization to Operate. The package includes the security plan, the assessment results, and the POA&M. NIST describes this decision in the Authorize step of the RMF (RMF Authorize Step).

A system with open weaknesses can still be authorized. The official weighs the mission need against the risk described in the POA&M. The POA&M is what makes that risk visible and bounded. It is not a hiding place for problems. It is the plan that proves problems are being worked.

The official may add conditions to the authorization. Common conditions include closing high risk items by a specific date. Those conditions land in the POA&M as new milestones. Missing them can cost the authorization.

Keeping the POA&M honest

Update the POA&M on a schedule, at least quarterly. Close entries only when the fix is verified in the live system. A fix that is "planned" or "partially done" is not closed.

Review milestones before they pass. A slipped date with a new realistic date is normal. A slipped date discovered after the fact breaks trust with the authorizing official.

Tie each entry to evidence. When you claim a weakness is closed, attach the export, the screenshot, or the test result that proves it. The POA&M earns its credibility one closed entry at a time.

Next step

PolicyCortex collects evidence from live Azure configuration using 33 collectors. The collectors read conditional access, diagnostic settings, Defender posture, backup, and firewall. The evidence is evaluated against NIST 800-53 and NIST 800-171. It supports re-verification after remediation. It generates SSP, SAR, and POA&M output from collected evidence. SSP means System Security Plan. SAR means Security Assessment Report. PolicyCortex is strongest in commercial Azure, and AWS is covered. Start at https://policycortex.com.

Sources

• NIST SP 800-37 Revision 2, Risk Management Framework for Information Systems and Organizations: A System Life Cycle Approach for Security and Privacy, National Institute of Standards and Technology, December 2018. https://doi.org/10.6028/NIST.SP.800-37r2
• NIST SP 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations, National Institute of Standards and Technology, September 2020. https://doi.org/10.6028/NIST.SP.800-53r5
• NIST SP 800-18 Revision 1, Guide for Developing Security Plans for Federal Information Systems, National Institute of Standards and Technology, February 2006. https://doi.org/10.6028/NIST.SP.800-18r1
• Risk Management Framework, Authorize Step, Computer Security Resource Center, National Institute of Standards and Technology. https://csrc.nist.gov/projects/risk-management/about-rmf/authorize-step