ISC2 Governance, Risk and Compliance (CGRC) Practice Question

A Plan of Action and Milestones (POA&M) is specifically designed to track identified security or privacy weaknesses, assign responsibility for their resolution, document interim risk-mitigation measures, and record the target dates for completing corrective actions. A risk assessment report identifies threats and vulnerabilities but does not necessarily list remediation owners or milestones. A configuration management plan describes processes for controlling system changes, and a continuous monitoring strategy outlines how controls will be observed over time; neither provides the detailed remediation schedule that auditors need when validating weakness tracking.