Which statement best describes the role of the Plan of Actions and Milestones (POA&M) in RMF?

• A. POA&M documents remediation actions and tracks progress toward compliance.
• B. POA&M replaces the SSP
• C. POA&M is a one-time document with no updates
• D. POA&M delays authorization

Answer: (A)

In RMF, the Plan of Actions and Milestones (POA&M) is the tool that captures known weaknesses in security controls, outlines the remediation steps, assigns responsibility and resources, sets target dates, and then tracks progress as those actions are completed. This creates a living record of how deficiencies will be addressed and how risk will be reduced over time, which is essential for the authorization decision and ongoing risk management. The POA&M complements the System Security Plan by showing what’s wrong and how it will be fixed, rather than replacing the SSP. It isn’t a one-time document—it's continuously updated as new findings emerge or as remediation actions move forward—so it supports ongoing monitoring and helps prevent delays in authorization by providing a clear path and timeline for achieving compliance.