CA-5 Plan of Action and Milestones

Guidance: draftPolicy clause: draftWhat these mean

Baselines	Implementation level	Enhancements
Low, Moderate, High, Privacy	Organization	1 (0 in a baseline)

Related controls: CA-2, CA-7, PM-4, PM-9, RA-7, SI-2, SI-12

Control statement

• a. Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system; and
• b. Update existing plan of action and milestones [Assignment: organization-defined frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.

NIST discussion

Plans of action and milestones are useful for any type of organization to track planned remedial actions. Plans of action and milestones are required in authorization packages and subject to federal reporting requirements established by OMB.

Control enhancements

CA-5(1) Automation Support for Accuracy and Currency

Baselines: Not in a baseline

Ensure the accuracy, currency, and availability of the plan of action and milestones for the system using [Assignment: organization-defined automated mechanisms].

Discussion and assessment objectives for CA-5(1)

Using automated tools helps maintain the accuracy, currency, and availability of the plan of action and milestones and facilitates the coordination and sharing of security and privacy information throughout the organization. Such coordination and information sharing help to identify systemic weaknesses or deficiencies in organizational systems and ensure that appropriate resources are directed at the most critical system vulnerabilities in a timely manner.

Determine if [Assignment: organization-defined automated mechanisms] are used to ensure the accuracy, currency, and availability of the plan of action and milestones for the system.

Examine: Assessment, authorization, and monitoring policy; procedures addressing plan of action and milestones; system design documentation; system configuration settings and associated documentation; system audit records; plan of action and milestones; system security plan; privacy plan; other relevant documents or records.

Interview: Organizational personnel with plan of action and milestones development and implementation responsibilities; organizational personnel with information security and privacy responsibilities.

Test: Automated mechanisms for developing, implementing, and maintaining a plan of action and milestones.

Assessment objectives (SP 800-53A)

Objectives and methods for CA-5

Determine if:

• CA-05a. a plan of action and milestones for the system is developed to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system;
• CA-05b. existing plan of action and milestones are updated [Assignment: organization-defined frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.

Examine: Assessment, authorization, and monitoring policy; procedures addressing plan of action and milestones; control assessment plan; control assessment report; control assessment evidence; plan of action and milestones; system security plan; privacy plan; other relevant documents or records.

Interview: Organizational personnel with plan of action and milestones development and implementation responsibilities; organizational personnel with information security and privacy responsibilities.

Test: Mechanisms for developing, implementing, and maintaining plan of action and milestones.

Policy statement

• The System owner shall develop a plan of action and milestones for the system that documents the planned remediation actions to correct weaknesses or deficiencies noted during control assessments and to reduce or eliminate known vulnerabilities in the system. (CA-5a)
• Each item in the plan of action and milestones shall record the weakness and its source, the responsible person or team, the resources required, the milestones and the scheduled completion date. (CA-5a)
• The System owner shall update the plan of action and milestones Fill in: the frequency at which to update an existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities Typical: at least monthly, and whenever an assessment, audit, scan or monitoring activity finds a new weakness, based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities. (CA-5b)
• The System owner shall record the reason for each change to a scheduled completion date, and close an item only with evidence that the weakness is corrected. (CA-5b)
• The Chief Information Security Officer shall review items past their scheduled completion date each month, and report them to the authorizing official. (CA-5b)

Federal systems

The Federal Information Security Modernization Act requires each agency’s information security program to include “a process for planning, implementing, evaluating, and documenting remedial action to address any deficiencies in the information security policies, procedures, and practices of the agency” (44 U.S.C. § 3554(b)(6)). OMB Circular A-130, Appendix I, section 4.c(15), requires agencies to use POA&Ms to record and manage the mitigation and remediation of identified weaknesses and deficiencies not associated with accepted risks, and to make them available to OMB, DHS, inspectors general and the U.S. Government Accountability Office on request. Section 4.k requires agencies to correct deficiencies identified through assessments, continuous monitoring and audits, and to track and manage their remediation through the POA&M process, with material deficiencies also reported in the annual Federal Managers Financial Integrity Act report. As of September 2026.

• The System owner shall record in the plan of action and milestones each weakness and deficiency not associated with an accepted risk, including those found by OMB reviews and internal or external audits, as OMB Circular A-130, Appendix I, sections 4.c(15) and 4.k, requires. (CA-5a)
• The Chief Information Security Officer shall make plans of action and milestones available to OMB, DHS, the inspector general and the U.S. Government Accountability Office on request, as OMB Circular A-130, Appendix I, section 4.c(15), requires. (CA-5b)

From the Assessment, Authorization, and Monitoring Policy template (draft). Highlighted fields are values your organization sets.

How to apply it

The plan of action and milestones (POA&M) records every known weakness until it is fixed or formally accepted. It is the connection between assessments and remediation, and assessors read it closely because it shows whether the organization acts on what it finds.

Common implementations. One POA&M per system, kept in a spreadsheet or GRC tool, fed by assessment reports, vulnerability scans, audits and continuous monitoring. Each item has an owner, milestones and a scheduled completion date; changes to dates are explained. The POA&M template lists the fields.

Organization-defined parameters. Typical values, which your organization may set differently:

Parameter	Typical value
Update frequency (b)	At least monthly, and whenever an assessment, audit, scan or monitoring activity finds a new weakness

Evidence assessors ask for.

• The current POA&M and its update history
• Traceability from each “other than satisfied” finding and each unremediated scan result to a POA&M item
• Evidence for items marked completed

Inheritance. Each system keeps its own POA&M; weaknesses in inherited common controls belong on the provider’s POA&M.

Common findings.

• Assessment findings or scan results missing from the POA&M.
• Scheduled completion dates moved repeatedly without explanation.
• Items closed without evidence of the fix.

Artifacts

• Assessment, Authorization, and Monitoring Decision Worksheet
• Assessment, Authorization, and Monitoring Policy
• Continuous Monitoring Strategy
• External Service Review
• Plan of Action and Milestones (POA&M)
• Security and Privacy Assessment Report
• System Security Plan