CGRC · Question #513
Which of the following is not part of the contents of a PO&Ms? Response:
The correct answer is D. Rules of engagement. A Plan of Action and Milestones (PO&M) details the tasks required to address security weaknesses, but does not typically include rules of engagement.
Question
Which of the following is not part of the contents of a PO&Ms? Response:
Options
- AScheduled completion date
- BResources required
- CRecommended actions and milestones
- DRules of engagement
How the community answered
(42 responses)- A2% (1)
- B5% (2)
- D93% (39)
Why each option
A Plan of Action and Milestones (PO&M) details the tasks required to address security weaknesses, but does not typically include rules of engagement.
A scheduled completion date is a critical component of a PO&M, providing a timeline for addressing identified weaknesses.
Resources required, such as funding, personnel, and equipment, are essential to include in a PO&M to ensure that remediation actions can be effectively implemented.
Recommended actions and milestones are the core elements of a PO&M, outlining the specific steps to mitigate vulnerabilities and track progress.
Rules of engagement define the scope and conduct for activities like penetration testing or incident response, which are distinct from the contents of a PO&M that outlines corrective actions for identified vulnerabilities. A PO&M focuses on remediation tasks, timelines, and necessary resources to fix security deficiencies.
Concept tested: Contents of a Plan of Action and Milestones (PO&M)
Source: https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-18r1.pdf
Topics
Community Discussion
No community discussion yet for this question.