CGRC Plan of Action and Milestones (POA&M)

Question 1

What is the primary purpose of a Plan of Action and Milestones (POA&M) in the NIST Risk Management Framework?

Accepted Answer

To track and manage the remediation of security weaknesses and deficiencies identified in an information system

Answer

A POA&M is a document that identifies tasks needing to be accomplished to correct weaknesses or deficiencies found in security controls. It includes resources required, scheduled completion dates, and responsible parties. It is not a strategic roadmap, incident log, or assessment schedule.

Question 2

Which of the following events would MOST appropriately trigger the creation of a new POA&M entry?

Accepted Answer

A security control is assessed as 'Other Than Satisfied' during the security assessment

Answer

POA&M entries are created when security controls are found to be 'Other Than Satisfied' (i.e., weaknesses or deficiencies are identified). Controls assessed as Satisfied do not need remediation tracking. An ATO and new policies do not automatically generate POA&M entries.

Question 3

Who is primarily responsible for reviewing and accepting the risk associated with items listed on a POA&M?

Accepted Answer

The Authorizing Official (AO)

Answer

The Authorizing Official is responsible for accepting the risk of operating a system with known weaknesses documented in the POA&M. The ISSO and System Owner manage the POA&M day-to-day, and the SCA identifies findings — but formal risk acceptance belongs to the AO.

Question 4

During continuous monitoring, an organization discovers that a POA&M item scheduled for completion 60 days ago has not been remediated and no extension was approved. What is the BEST course of action?

Accepted Answer

Escalate the overdue item to the Authorizing Official and document the updated status and revised milestones

Answer

Overdue POA&M items must be escalated to the Authorizing Official, who has the authority to accept the continued risk, demand immediate remediation, or revoke authorization. Revoking the ATO is an option the AO may choose, but it is not automatic. Deleting items or transferring them to the SSP as accepted risk without AO involvement is inappropriate.

Question 5

Which of the following is a required data element in a properly formatted POA&M entry?

Accepted Answer

The estimated cost and scheduled completion date for remediation

Answer

Required POA&M fields include the weakness description, resources required (including estimated cost), responsible parties, and scheduled completion milestones/dates. Discoverer identity, vendor lists, and configuration hashes are not standard required POA&M elements per OMB and NIST guidance.

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC - Certified Governance Risk and Compliance Practice Test

CGRC Plan of Action and Milestones (POA&M)