ISC2 Governance, Risk and Compliance (CGRC) Practice Question

A Plan of Action and Milestones (POA&M) is intended to manage outstanding weaknesses by laying out the remedial actions that will bring residual risk to an acceptable level. Core elements therefore include the milestones and target completion dates for each weakness, along with the resources and responsible parties. Without scheduled dates, an authorizing official cannot judge whether risk will be reduced within an acceptable time frame. Control-to-family cross-references, network diagrams, and lists of testing tools may be useful elsewhere in the authorization package but they are not required components of the POA&M itself and do not, by themselves, let management monitor progress toward risk reduction.