# Plan of Action and Milestones (POA&M)

**Template version:** 1.0.0 · **Edition:** Ready to adopt · **NIST basis:** SP 800-53 Rev. 5, release 5.2.0

*Tailor this template before adoption; it is not legal advice.* Latest version: <https://kston83.github.io/nist-guide/templates/forms/plan-of-action-and-milestones/>. Dedicated to the public domain under CC0 1.0 (<https://creativecommons.org/publicdomain/zero/1.0/>): adopt and change it without attribution.

| System | System owner | Last updated | Updated by |
| --- | --- | --- | --- |
| [Fill in: system name and identifier] | [System owner] | [Fill in: date] | [Fill in: name and title] |

## How to use this register

- Add an item for each weakness or deficiency found in a control assessment, and for each known vulnerability the system has not yet fixed (CA-5a).
- Update the register [Fill in: the frequency at which to update an existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities. Typical: at least monthly, and whenever an assessment, audit, scan or monitoring activity finds a new weakness], using the findings of control assessments, independent audits or reviews, and continuous monitoring (CA-5b).
- Keep closed items, with their completion date and evidence, so the history supports the next assessment.
- When the [System owner] proposes to accept a risk instead of fixing it, record the authorizing official's decision and its date in the item.

| Field | What to record |
| --- | --- |
| ID | A unique, permanent identifier for the item |
| Weakness | A short name and a description of the weakness |
| Source | Where it was found: assessment, scan, audit, incident or continuous monitoring, with the report reference |
| Controls | The controls affected, such as AC-2 or SI-2 |
| Affected components | The components or services where the weakness exists |
| Date identified | When the weakness was found |
| Risk level | The risk the weakness poses, using the organization's risk scale |
| Owner | The role responsible for fixing it |
| Resources required | Funding, staff or tools needed, or "none" |
| Milestones | Interim steps, each with a planned date |
| Scheduled completion | The date the weakness will be fixed |
| Status | Open, completed or risk accepted |
| Completion date and evidence | When it was fixed and where the evidence is |
| Comments | Changes to dates, with the reason and who approved them |

## Register

| ID | Weakness | Source | Controls | Affected components | Date identified | Risk level | Owner | Resources required | Milestones | Scheduled completion | Status | Completion date and evidence | Comments |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| [Fill in: ID] | [Fill in: weakness] | [Fill in: source and report reference] | [Fill in: controls] | [Fill in: components] | [Fill in: date] | [Fill in: risk level] | [Fill in: owner role] | [Fill in: resources] | [Fill in: milestones and dates] | [Fill in: date] | [Fill in: status] | [Fill in: date and evidence location] | [Fill in: comments] |