ISC2 Governance, Risk and Compliance (CGRC) Practice Question

NIST SP 800-37 and related federal guidance define the authorization package as consisting of the System Security Plan (SSP), Security Assessment Report (SAR), and the Plan of Action and Milestones (POA&M). Any control weaknesses or deficiencies that cannot be remediated before the authorization decision must be recorded in a POA&M. Each entry must identify the weakness, planned remediation actions, responsible party, required resources, and a realistic milestone date for completion. Omitting the findings, delaying their documentation, or combining them into a single vague statement would deprive the authorizing official of the information needed to make a risk-based decision and violates OMB and NIST requirements. Therefore, the analyst should create or update the POA&M to include each unresolved finding with appropriate details and timelines, and submit it as part of the authorization package.