ISC2 Governance, Risk and Compliance (CGRC) Practice Question

The Plan of Action and Milestones (POA&M) is the RMF-mandated document for recording each corrective action that results from an assessment or audit, assigning an owner, identifying required resources, and setting target completion dates. Although a risk register records risks and may note high-level treatment strategies, the POA&M is the authoritative tool used to manage the detailed remediation tasks for audit findings. A system security plan describes existing or planned controls, and a continuous monitoring strategy defines how controls will be assessed over time-neither serves to track specific post-audit corrective actions.