From the course: NIST 800-53r5: Introduction to Security and Privacy Controls

Unlock this course with a free trial

Join today to access over 24,900 courses taught by industry experts.

POA&M

POA&M

From the course: NIST 800-53r5: Introduction to Security and Privacy Controls

Start my 1-month free trial Buy for my team

POA&M

“

- Okay, so in lesson 2.9, we're going to talk about plan of action and milestones or the POA&M. I kind of mentioned this before, but now is the last lesson. We're getting to the last part of the lifecycle of a weakness, vulnerability, security control, mapping it to an actual risk. So this lesson, you'll learn about why we have POA&Ms. Seems kind of obvious, but we're going to explain that. Interpret the components, the different parts that we need for a POA&M, what makes sense. And then, critique some POA&M entries. Here's the components of a plan of action and milestone. So you first need to document the weakness. Obviously, we need to say what it is, what we found. You need to allocate resources. This is why we're procuring a plan. You have to name a person or resource or role that is going to do something about. That's going to be in charge of fixing it, that's going to be in charge of monitoring it, so that you don't just put a weakness out there and no idea who's going to fix…

Contents