thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

Governance, Risk, Audit & Privacy · Intermediate

Plan of Action and Milestones (POA&M)

Document tracking weaknesses, planned remediation actions, resources, and target completion dates.

Definition

A POA&M lists deficiencies identified in assessments or monitoring, responsible parties, milestones, and status. It is required under FISMA, FedRAMP, and in limited conditional form under CMMC Level 2 (certain requirements may be on a POA&M for up to 180 days). It is a key tool for tracking risk remediation.

Example

A POA&M item commits to implementing FIPS-validated encryption on backup media within 120 days.

Exam tip

Under CMMC 2.0 a conditional status with POA&M requires closeout within 180 days and a minimum score threshold.

Related terms