POAM update frequency is at discretion of System Owner but should be frequent enough to provide an accurate status of progress in remediation. Response:

The correct answer is A. True. It is true that the frequency of Plan of Action and Milestones (POAM) updates is at the system owner's discretion, but they must be frequent enough to accurately reflect remediation progress.

Compliance Maintenance

Question

Options

ATrue
BFalse

How the community answered

(48 responses)

A
92% (44)
B
8% (4)

Why each option

It is true that the frequency of Plan of Action and Milestones (POAM) updates is at the system owner's discretion, but they must be frequent enough to accurately reflect remediation progress.

ATrueCorrect

While there isn't a universally mandated strict update schedule, the system owner is responsible for managing the POAM and ensuring its accuracy. Regular, timely updates are essential for stakeholders to monitor progress on vulnerability remediation and for the authorizing official to make informed risk management decisions.

BFalse

Concept tested: POAM update responsibility and frequency.

Source: https://csrc.nist.gov/glossary/term/plan-of-action-and-milestones

Topics

#POAM#Remediation Tracking#Compliance Maintenance#System Owner Responsibilities

Community Discussion

No community discussion yet for this question.

Full CGRC Practice