# Plan of Action and Milestones (POA&M)

**Template version:** 1.0.0 · **Edition:** Annotated (with guidance) · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/forms/plan-of-action-and-milestones/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

> **Guidance:** The POA&M is where every known weakness lives until it is fixed or formally accepted. Assessors check three things: that every "other than satisfied" finding and every unremediated scan result appears here, that each item has an owner and a realistic date, and that overdue items are explained rather than silently moved. Keep one POA&M per system, usually as a spreadsheet or in a GRC tool; the register below is also downloadable as a CSV file.

| System | System owner | Last updated | Updated by |
| --- | --- | --- | --- |
| [Fill in: system name and identifier] | [System owner] | [Fill in: date] | [Fill in: name and title] |

## How to use this register

- Add an item for each weakness or deficiency found in a control assessment, and for each known vulnerability the system has not yet fixed (CA-5a).
- Update the register [Fill in: the frequency at which to update an existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities. Typical: at least monthly, and whenever an assessment, audit, scan or monitoring activity finds a new weakness], using the findings of control assessments, independent audits or reviews, and continuous monitoring (CA-5b).
- Keep closed items, with their completion date and evidence, so the history supports the next assessment.
- When the [System owner] proposes to accept a risk instead of fixing it, record the authorizing official's decision and its date in the item.

| Field | What to record |
| --- | --- |
| ID | A unique, permanent identifier for the item |
| Weakness | A short name and a description of the weakness |
| Source | Where it was found: assessment, scan, audit, incident or continuous monitoring, with the report reference |
| Controls | The controls affected, such as AC-2 or SI-2 |
| Affected components | The components or services where the weakness exists |
| Date identified | When the weakness was found |
| Risk level | The risk the weakness poses, using the organization's risk scale |
| Owner | The role responsible for fixing it |
| Resources required | Funding, staff or tools needed, or "none" |
| Milestones | Interim steps, each with a planned date |
| Scheduled completion | The date the weakness will be fixed |
| Status | Open, completed or risk accepted |
| Completion date and evidence | When it was fixed and where the evidence is |
| Comments | Changes to dates, with the reason and who approved them |

## Register

| ID | Weakness | Source | Controls | Affected components | Date identified | Risk level | Owner | Resources required | Milestones | Scheduled completion | Status | Completion date and evidence | Comments |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: ID] | [Fill in: weakness] | [Fill in: source and report reference] | [Fill in: controls] | [Fill in: components] | [Fill in: date] | [Fill in: risk level] | [Fill in: owner role] | [Fill in: resources] | [Fill in: milestones and dates] | [Fill in: date] | [Fill in: status] | [Fill in: date and evidence location] | [Fill in: comments] |