Knowledge is Power
BARE METAL CYBERKnowledge is Power

Sitewide Search

Search Bare Metal Cyber

Search courses, individual lessons, wiki entries, books, podcasts, magazine articles, Daily Cyber News, and Darwin.

NIST SP 800-171 CUI Protection Center

03.12.02 — Plan of Action and Milestones

Read the official CUI requirement and assessment content, then use the separately labeled Bare Metal Cyber perspective to connect it to implementation, evidence, and sustained operation.

1Source controls
5Assessment objectives
3Assessment methods

03.12 — Security Assessment and Monitoring · NIST SP 800-171 Revision 3

Active
Official NIST requirement content

Security requirement

  1. a.Develop a plan of action and milestones for the system:
    1. 1.To document the planned remediation actions to correct weaknesses or deficiencies noted during security assessments and
    2. 2.To reduce or eliminate known system vulnerabilities.
  2. b.Update the existing plan of action and milestones based on the findings from:
    1. 1.Security assessments,
    2. 2.Audits or reviews, and
    3. 3.Continuous monitoring activities.
Official NIST discussion

Discussion

Plans of action and milestones (POAMs) are important documents in organizational security programs. Organizations use POAMs to describe how unsatisfied security requirements will be met and how planned mitigations will be implemented. Organizations can document system security plans and POAMs as separate or combined documents in any format. Federal agencies may consider system security plans and POAMs as inputs to risk-based decisions on whether to process, store, or transmit CUI on a system hosted by a nonfederal organization.

Bare Metal Cyber interpretation

Implementation perspective

Treat Plan of Action and Milestones as a CUI protection outcome that must be reflected in the system boundary, documented implementation, operational behavior, and assessment evidence. Pay particular attention to assessment planning, evidence quality, remediation, continuous monitoring, and system security plan accuracy.

  1. Confirm the requirement is in scope for the CUI system components, services, users, and external connections being assessed.
  2. Resolve every organization-defined parameter through an approved governance and tailoring process.
  3. Map each clause of the requirement to an accountable owner, implementation mechanism, and evidence source.
  4. Verify that inherited and shared implementations are supported by current provider evidence and responsibility boundaries.
  5. Collect evidence during normal operation and review changes, exceptions, and deficiencies on a risk-based cadence.

Questions to ask

  • Which CUI assets, data flows, users, and services are protected by this requirement?
  • Which portions are implemented locally, inherited, shared, or not applicable, and what evidence supports that determination?
  • Do the system security plan, deployed configuration, operating process, and assessment evidence tell the same story?
  • What change, incident, or threshold should trigger reassessment?

Evidence and validation

  • assessment plans and reports
  • plans of action and milestones
  • system security plans
  • continuous monitoring results

Common failure patterns

  • requirement status based only on owner assertion
  • findings closed without evidence
  • scope missing inherited services
  • monitoring data disconnected from risk decisions
Official NIST SP 800-171A content

Assessment objectives and methods

Assessment objectives (5)
  1. a.1.

    a plan of action and milestones for the system is developed to document the planned remediation actions for correcting weaknesses or deficiencies noted during security assessments.

  2. a.2.

    a plan of action and milestones for the system is developed to reduce or eliminate known system vulnerabilities.

  3. b.1.

    the existing plan of action and milestones is updated based on the findings from security assessments.

  4. b.3.

    the existing plan of action and milestones is updated based on the findings from continuous monitoring activities.

  5. b.2.

    the existing plan of action and milestones is updated based on the findings from audits or reviews.

Examine

  • security assessment and monitoring policy and procedures
  • procedures for plans of action and milestones
  • security assessment plan
  • security assessment report
  • security assessment evidence
  • plan of action and milestones
  • system security plan
  • other relevant documents or records

Interview

  • personnel with plans of action and milestones development and implementation responsibilities
  • personnel with information security responsibilities

Test

  • mechanisms for developing, implementing, and maintaining plans of action and milestones
Official source-control relationships

Source NIST SP 800-53 controls

These controls are referenced by the official SP 800-171 Rev. 3 OSCAL record. Open the corresponding control pages for complete control text, enhancements, D3FEND mappings, and related learning.

Source controlCA-5Open SP 800-53 control →
Source record

Authoritative sources

Bare Metal Cyber is an independent educational publisher and is not affiliated with or endorsed by NIST. The official publications, the responsible federal agency, and the governing contract or agreement determine applicability, tailoring, assessment depth, and required implementation.