ISC2 Governance, Risk and Compliance (CGRC) Practice Question

A Plan of Action and Milestones (POA&M) is required for every federal information system that proceeds to operation with outstanding weaknesses. It captures each identified vulnerability, the residual risk it poses, the resources needed, the person responsible, and a target completion date. The Security Assessment Report summarizes test results but does not track future remediation tasks. A Configuration Baseline defines approved system settings and cannot substitute for risk tracking. The Incident Response Plan addresses handling of security events, not documenting known but unresolved vulnerabilities.