ISC2 Governance, Risk and Compliance (CGRC) Practice Question

The Plan of Action and Milestones (POA&M) is the RMF artifact specifically designed to document residual weaknesses that remain after controls are implemented. It lists each outstanding vulnerability, describes the planned corrective action, assigns responsibility, and provides scheduled completion dates so that progress can be tracked and risk decisions can be made. The Security Assessment Report summarizes assessment results but does not track future remediation work. The System Security Plan describes the control environment rather than residual issues. A risk register may log organizational risks broadly, but the RMF requires the POA&M for formal residual-risk reporting to the authorizing official.