Which document is used to plan and track remediation actions for identified weaknesses in RMF?

• A. PMO Charter.
• B. POA&M.
• C. SSP.
• D. SAR.

Answer: (B)

In RMF, weaknesses found in security controls are managed with a Plan of Actions and Milestones. This document lays out each identified deficiency, the specific remediation steps needed, who is responsible, and target dates. It acts as the living roadmap for reducing risk, showing how and when weaknesses will be fixed and tracked over time, which supports ongoing authorization decisions.

Other documents have different roles: a PMO Charter governs project governance and oversight; a System Security Plan describes how the security controls are implemented and operated in the system; a Security Assessment Report records the findings and evidence from the assessment. The Plan of Actions and Milestones is the tool that links identified weaknesses to concrete remediation actions and milestones, making it the appropriate choice for planning and tracking remediation efforts.