The Department of Homeland Security indicates that a Plan of Action and Milestones (POA&M) is mandated by the Federal Information Systems Management Act of 2002 (FISMA) as a corrective action plan for tracking and planning the resolution of information security weaknesses. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones. (Source)
A complete guide to creating, managing, and closing your system’s POA&M This training is intended to provide guidance for developing effective POA&Ms. The guidance in this Attachment is written to assist DHS and its Components in implementing the POA&M process. This link provides a FedRAMP POA&M template. This example policy from the USDA can be referenced for how they handle identifying, assessing, prioritizing, and monitoring the progress of corrective efforts for security vulnerabilities. In this YouTube video the plan of action and milestones (POA&M) document is introduced and explained.
This document provides assessment guidance for Level 1 of the Cybersecurity Maturity Model Certification (CMMC). This document provides assessment guidance for conducting Cybersecurity Maturity Model Certification (CMMC) assessments for Level 2. The purpose of this publication is to provide procedures for assessing the CUI requirements in NIST Special Publication 800-171.