nerdexam
(ISC)2

CGRC · Question #324

What is included in a POA&M that is presented to the Approving Authority as part of the initial authorization package? Response:

The correct answer is C. Deficiencies that have not yet been remediated and verified throughout the RMF process. A Plan of Action and Milestones (POA&M) presented for initial authorization includes all identified security deficiencies that have not yet been fully remediated and verified.

Security and Privacy Governance, Risk Management, and Compliance Program

Question

What is included in a POA&M that is presented to the Approving Authority as part of the initial authorization package? Response:

Options

  • AAll failed controls identified throughout the RMF process
  • BOnly volatile findings that require prioritization in remediation
  • CDeficiencies that have not yet been remediated and verified throughout the RMF process
  • DOnly findings that have been evaluated as moderate or high

How the community answered

(51 responses)
  • A
    4% (2)
  • B
    6% (3)
  • C
    88% (45)
  • D
    2% (1)

Why each option

A Plan of Action and Milestones (POA&M) presented for initial authorization includes all identified security deficiencies that have not yet been fully remediated and verified.

AAll failed controls identified throughout the RMF process

A POA&M includes *unremediated* failed controls; those already remediated and verified would not be listed.

BOnly volatile findings that require prioritization in remediation

While volatile findings might be prioritized, a POA&M includes all unmitigated deficiencies regardless of volatility, provided they are not yet resolved.

CDeficiencies that have not yet been remediated and verified throughout the RMF processCorrect

A POA&M is a document that lists all security weaknesses or deficiencies found during the assessment process that have not been remediated and verified by the time the authorization package is submitted. It details the corrective actions, responsible parties, and target completion dates for each deficiency to reduce residual risk.

DOnly findings that have been evaluated as moderate or high

A POA&M includes all unmitigated deficiencies, not just those evaluated as moderate or high, as all deficiencies contribute to residual risk.

Concept tested: RMF - Plan of Action and Milestones (POA&M)

Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-37r2.pdf

Topics

#POA&M#RMF Authorization#Deficiencies#Risk Acceptance

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full CGRC Practice