Plan of Action and Milestones (POA&M)
OSCAL Model: Plan of Action and Milestones
The Plan of Action and Milestones (POA&M) model tracks known risks, weaknesses, and deficiencies in a system’s security posture along with the planned remediation activities, milestones, and timelines for addressing them.
Summit Context
This directory contains the OSCAL POA&M artifacts for the Summit system by Oscalate Systems. These files track identified risks and the remediation actions planned to address them.
What Belongs Here
- OSCAL POA&M files (JSON, XML, or YAML)
- Remediation plans and milestone tracking
- Risk response documentation
Key Concepts
- Import SSP: Reference to the system’s SSP
- POA&M Items: Individual tracked items requiring remediation
- Findings: References to assessment findings that generated the POA&M item
- Risks: Documented risks associated with each item
- Observations: Supporting evidence and context
- Milestones: Planned remediation milestones with target dates
OSCAL Reference