Plan of Action and Milestones (POA&M) template: The register of a system's known weaknesses and the planned actions, milestones and dates to fix them, as SP 800-53 CA-5 requires.
Add an item for each weakness or deficiency found in a control assessment, and for each known vulnerability the system has not yet fixed (CA-5a).
Update the register Fill in: the frequency at which to update an existing plan of action and milestones based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities Typical: at least monthly, and whenever an assessment, audit, scan or monitoring activity finds a new weakness, using the findings of control assessments, independent audits or reviews, and continuous monitoring (CA-5b).
Keep closed items, with their completion date and evidence, so the history supports the next assessment.
When the System owner proposes to accept a risk instead of fixing it, record the authorizing official’s decision and its date in the item.
Field
What to record
ID
A unique, permanent identifier for the item
Weakness
A short name and a description of the weakness
Source
Where it was found: assessment, scan, audit, incident or continuous monitoring, with the report reference
Controls
The controls affected, such as AC-2 or SI-2
Affected components
The components or services where the weakness exists
Date identified
When the weakness was found
Risk level
The risk the weakness poses, using the organization’s risk scale
Owner
The role responsible for fixing it
Resources required
Funding, staff or tools needed, or “none”
Milestones
Interim steps, each with a planned date
Scheduled completion
The date the weakness will be fixed
Status
Open, completed or risk accepted
Completion date and evidence
When it was fixed and where the evidence is
Comments
Changes to dates, with the reason and who approved them
Independent guidance, not an official NIST publication. Control text is from NIST SP 800-53 Rev. 5 and SP 800-53A (public domain). Original content is licensed CC BY 4.0; program templates and the downloadable kit are dedicated to the public domain under CC0 1.0.