What is a Plan of Actions and Milestones (POA&M) used for in RMF?

• A. It lists control deficiencies, remediation actions, owners, and target dates.
• B. It provides the initial baseline set of controls for a system.
• C. It documents the authorization decision and conditions.
• D. It describes the system boundary and environment.

Answer: (A)

In RMF, a POA&M is the record used to track deficiencies in security controls and the steps planned to fix them, including who is responsible and by when. It captures each control deficiency identified during assessment, the remediation actions needed, the designated owner, and the target dates for completion. This makes it a living plan that you use to manage risk over time, show progress to management and the authorizing official, and update risk posture as fixes are implemented. It helps ensure accountability and visibility into how residual risk is being reduced.

The other items live in different RMF artifacts. The initial baseline set of controls is defined and documented in the Security Plan (or control baseline documentation). The authorization decision and any conditions are documented in the Authorization Decision Document or formal authorization letter. The system boundary and environment are described in system characterization or boundary-related documentation.