What a NIST 800-53 POA&M must contain and who approves it
If an agency, contract or authorization requires a plan of action and milestones, the short answer is this: control CA-5 requires a documented plan for the system that records planned remediation of weaknesses or deficiencies found in control assessments, along with known vulnerabilities, and the authorizing official approves that plan as part of the authorization decision. The plan must be updated at a frequency the organization defines, drawing on assessments, independent audits or reviews, and continuous monitoring. Your organization owns the POA&M, its content and its accuracy. Each entry should name the weakness, the affected control, the responsible role, the planned remediation steps and the milestones that show progress. An implementation partner can help build the tracking process, gather the scan results and assessment findings that feed it, and keep the document current in the format your team uses. An independent assessor reviews the POA&M against the assessment results but does not write or approve it.
What a POA&M must contain depends on the system, its authorization boundary, its impact level and the risk each weakness creates. A low-impact system with a few configuration findings will have a short plan. A high-impact system with inherited controls, third-party components and open vulnerabilities will need entries that trace back to specific assessment objects and show who owns each inherited control. Confirm the exact fields, review frequency and approval workflow with your authorizing official or contracting office before you draft the first version, because those requirements come from the authorizing body and the agreement, not from the control text alone. Ask any partner for a sample POA&M structure and a written description of how entries will be verified as closed.
Which baselines include CA-5 and what that means for scope
This table shows which SP 800-53B Release 5.2.0 baselines select CA-5 Plan of Action and Milestones and what each one means for your own scope. Read each row as the starting point for your tailoring record, not as a final selection for your system. The main takeaway is that CA-5 is not optional in any of the four baselines, so the POA&M process must be designed into your program from the start.
| Baseline | CA-5 selected | What the organization should confirm in its tailoring |
|---|---|---|
| Low security baseline | Yes | Confirm that the POA&M is scoped to the system boundary and that tailoring has not removed CA-5 without documented justification. |
| Moderate security baseline | Yes | Confirm the update frequency defined in your organization parameters and who owns weakness tracking across inherited and system-level controls. |
| High security baseline | Yes | Confirm that enhancements and organization-defined parameters for remediation tracking match your authorization package expectations and assessor requests. |
| Privacy baseline | Yes | Confirm that privacy-related weaknesses and deficiencies are captured in the same POA&M or in a documented, linked privacy tracking process. |
| Tailored system (any impact level) | Yes, unless removed by documented tailoring | Record any change to the selection with justification, the approving official and the date, and confirm it against the current OSCAL profile. |
How a POA&M moves from assessment finding to closure
The sequence turns each weakness found in a control assessment, independent review or continuous monitoring into a tracked remediation item with an owner, a milestone and a status. Each item stays open until its closure is verified and the authorizing official has seen the plan that records it.
Log each finding from assessment and monitoring
Weaknesses and deficiencies come from several sources: control assessments, independent audits or reviews, continuous monitoring and known vulnerabilities. The control owner or security team records each one as a separate POA&M item, with the affected control, the system it applies to and the source that surfaced it. The step is complete when every finding from the assessment report has a matching item, so none exists only in an email or a scan export.
Assign remediation, owner and milestones
For each item, the organization records the planned remediation, the person accountable for delivering it, and the milestones that show progress toward closure. Where a weakness cannot be fixed immediately, the entry should say whether the plan mitigates the risk in the meantime or eliminates the weakness. The step is complete when each item has a named owner, a planned action and a status value that a reviewer can read without asking the team for context.
Track status through the monitoring cycle
Owners update milestones and status as work progresses, and new findings from scans, reviews or incidents are added as they arise. Items that slip or change scope are revised in the plan rather than silently reset. The output is a current plan with a history of changes. Confirm the update frequency your authorization package defines, because CA-5 requires updates at a defined frequency and the organization sets that cadence.
Review the plan on the defined schedule
On the defined schedule, the security lead or compliance team reviews the full plan for completeness, overdue items and items that depend on other systems or inherited controls. Reviewers check that each open item still matches a current finding and that the remediation approach still fits the system's risk. The output is a dated revision of the plan that records what changed since the previous version.
Obtain authorizing official approval
Under SP 800-37 Rev. 2, the authorizing official approves plans of action and milestones and decides whether significant changes to the system require reauthorization. The approved version, with the approval record and date, goes into the authorization package. The step is complete when the authorizing official's decision is documented against the current plan, and any risk they accept is written down with its basis.
Implement and document each remediation
Owners carry out the planned remediation or mitigation and collect the evidence that shows the change. Evidence might include configuration exports, patch records, updated procedures or test results, depending on the control. The step produces a documented change for each item, linked to the POA&M entry. Confirm with your assessor which evidence types they will accept for each control family before work begins.
Verify closure and close the item
An independent or otherwise separate reviewer checks the evidence against the original finding and the control's assessment procedure. Items that pass are closed with the closure date, the verifier and a reference to the evidence. Items that do not pass stay open with a revised milestone. The output is a closed item with traceable proof, and the closure is reflected in the next plan update that goes to the authorizing official.
Who approves the POA&M and when reauthorization applies
The authorizing official approves the plan of action and milestones, and the approval sits with the organization, not with the assessor. Under SP 800-37 Rev. 2, the authorizing official approves plans, memorandums of agreement or understanding and plans of action and milestones, and also decides whether a significant change to the system or its environment requires reauthorization. An independent assessor tests whether the POA&M exists, is updated and matches the findings in the assessment report, but the assessor does not accept the risk or commit the organization to the dates. Ask who in your organization holds the authorizing official role for each system, and confirm in writing that this person has reviewed the current POA&M before any authorization package is submitted.
The information system security officer (ISSO) or system owner usually drafts and maintains the document, with the security team supplying the weakness data and the remediation status. In practice the ISSO or system owner records each weakness, its source (control assessment, independent audit, review or continuous monitoring), the planned remediation, the responsible party and the milestone dates, then routes changes to the authorizing official. The security team keeps the scanner and tracking data aligned with the entries so that a vulnerability closed in a ticketing system is also closed in the POA&M. Assign one named owner for each entry, and define who may change a milestone date and who must approve the change.
Reauthorization is triggered by significant change, and the authorizing official makes that call, so the POA&M review should be part of the change process. A change to the system boundary, architecture, hosting environment or core security functions is a common trigger candidate, but whether a specific change is significant depends on your organization's criteria and the authorizing official's judgment. Document those criteria in the continuous monitoring strategy and record each decision, including decisions that no reauthorization is needed. Before a planned change, confirm with the authorizing official whether the change requires reauthorization and whether any open POA&M items must be closed or re-dated first.
What assessors examine for CA-5 under SP 800-53A
Examine objects are the documents and records an assessor reads to confirm that a plan exists, reflects the assessment results and is kept current. For CA-5 the assessment procedure names the control assessment plan, the control assessment report, control assessment evidence and the plan of action and milestones itself. The assessor is checking that each weakness in the report traces to an entry in the POA&M, and that the entry shows what will be done, who owns it and when it will be done.
- Control assessment plan: Show the scope and test approach that produced the findings, so the assessor can match each POA&M item to a control and an assessment method.
- Control assessment report: Keep the findings in the report and the open items in the POA&M consistent, with the same control identifiers and wording.
- Control assessment evidence: Retain the artifacts behind each finding, such as scan output, configuration exports and test results, so the stated weakness can be verified.
- The POA&M itself: Include the weakness, the planned remediation, milestones, responsible party, status and the date of the last update, with a revision history.
Before the assessment, read the POA&M against the latest report line by line and confirm that no finding is missing or stale.
Interview objects are the people an assessor questions about how the plan of action and milestones is developed, approved and carried out. The procedure names organizational personnel with POA&M development and implementation responsibilities. The assessor wants to hear the same account from the people who write the plan, the people who fix the weaknesses and the people who approve the plan, and to see that the account matches the documents.
- Plan authors: Expect questions on how weaknesses enter the POA&M, how priority is set and how the planned remediation is chosen.
- Remediation owners: Expect questions on whether milestones are realistic for the work, what blocks progress and how slipped dates are escalated.
- Approvers: Expect questions on who signs the plan, how the authorizing official is informed and when a significant change would require reauthorization.
- Reviewers and monitors: Expect questions on how updates are triggered by assessments, audits and continuous monitoring, and at what frequency the organization set for updates.
Prepare a short role map that names each person, their responsibility for the POA&M and their backup, so interviews stay consistent with the record.
Test objects are the mechanisms the assessor exercises to see whether the organization can develop, implement and maintain its POA&M. The procedure names the mechanisms for developing, implementing and maintaining the plan of action and milestones. Here the assessor is less interested in a single document and more interested in whether the process runs, produces accurate entries and keeps them current over time.
- Development mechanism: Show the workflow or template used to create entries, including required fields and the approval step.
- Implementation mechanism: Show how remediation work is tracked to completion, such as tickets linked to POA&M items, with closure criteria.
- Maintenance mechanism: Show how the plan is refreshed after assessments, audits and monitoring results, and how closed items are verified before removal.
- Sample walkthrough: Be ready to trace one or more items from a finding, through the ticket, to closure evidence, in front of the assessor.
Run a dry walkthrough of one closed and one open item before the assessor arrives, and fix any gap the walkthrough exposes.
Common POA&M gaps that assessors flag
Assessors and authorizing officials rarely reject a POA&M for having open items. They reject it when the items cannot be traced, verified and kept current. The cards below cover the gaps that recur most often in CA-5 reviews and the checks that prevent them.
Vague remediation actions
A entry that says "harden logging" or "fix patching" gives an assessor nothing to test. Each item should name the change, the component it touches and the artifact that will prove completion, such as a configuration file, a scan result or a change ticket. Ask whether a reviewer who did not write the entry could tell when it is finished. If not, rewrite it before the next assessment.
Missing owners or dates
An item without a named accountable person, or with a scheduled completion date that has passed without revision, signals that no one is managing it. CA-5 expects the plan to be operated, and the people with remediation responsibility are part of what an interviewer will ask about. Assign one owner per item, record the scheduled completion date, and document every change to that date with a reason.
Items not linked to findings
A POA&M item that does not point to a specific control assessment finding, vulnerability or continuous monitoring observation is hard to justify. Assessors check whether every weakness in the assessment report appears in the plan and whether the plan contains items with no source. Keep an identifier for each finding and cross-reference it in both documents.
No approval record
Under SP 800-37 Rev. 2, authorizing officials approve plans of action and milestones. A POA&M that circulates without a dated approval, or whose approver cannot be identified, leaves the risk acceptance undocumented. Keep the approval history with the version, the approver and the date, and confirm with your authorizing official how they want changes that increase risk to be handled.
Stale updates after new scans
A plan that still reflects last quarter's vulnerability scan after a new scan has run shows that CA-5 updates are not tied to monitoring. Check whether new scan results, independent reviews and monitoring findings each trigger a POA&M review. Closed items should carry the evidence that closed them, and new findings should appear with their dates.
Why FedRAMP handles weaknesses under its own rules, not CA-5
None of the FedRAMP Rev5 Class B, C or D control lists includes CA-5, even though CA-5 is selected in NIST's own low, moderate and high baselines. A team that builds a FedRAMP package by copying the NIST baseline will therefore not find a CA-5 requirement on the FedRAMP side. FedRAMP handles known weaknesses through its own vulnerability and corrective action rules, which set how quickly findings must be addressed and how they are reported. The practical decision is to keep a working plan of action and milestones for your internal governance and for any NIST-based authorization, while building the FedRAMP reporting cadence from FedRAMP's current rules rather than from the NIST control text.
FedRAMP separates mitigation, which reduces a vulnerability's risk and impact, from remediation, which eliminates the vulnerability. Those two outcomes are tracked differently. A mitigating control, such as a compensating network restriction, may satisfy the rules while the underlying flaw remains, and the record must show which of the two has happened. FedRAMP also sets class-based timeframes for reducing potential agency impact, and those timeframes depend on whether a vulnerability is reachable from the internet and likely to be exploited. Confirm the current timeframes and the classification criteria in the FedRAMP Consolidated Rules for 2026 before you set internal deadlines, and do not copy them from memory or from an older rule set.
Plan the work with the rules in front of you. Ask your authorizing official or FedRAMP-recognized assessor which rule set applies to your package, map each open weakness to its exploitability and exposure, and record whether each entry is a mitigation or a remediation. Confirm with your assessor how FedRAMP expects the findings to appear in your continuous monitoring deliverables, because the POA&M you keep for NIST purposes may not match the format or deadlines FedRAMP requires. Treat the FedRAMP machine-readable rules as the reference you check against each time they change.
NIST 800-53 POA&M questions buyers ask
Is a POA&M required at every impact level under NIST 800-53?
Yes, CA-5 is selected in the low, moderate and high baselines and in the privacy baseline, so the plan applies whatever the system's impact level. What changes between levels is the number of controls that can produce findings, which means a high-impact system usually carries a longer list of items to track. Confirm the selected baseline for your system in your own security categorization and tailoring documentation, since the baseline profiles in the OSCAL content are the reference point for that selection.
Does CA-5 appear in FedRAMP requirements?
No. None of FedRAMP's Rev5 Class B, C or D control lists includes CA-5, even though NIST's baselines do. FedRAMP handles weaknesses through its own vulnerability and corrective action rules, which distinguish mitigation from remediation and set class-based timeframes tied to whether a vulnerability is internet-reachable and likely exploitable. A cloud provider pursuing FedRAMP should read those rules directly and treat them as the operative requirement, while keeping an internal plan that satisfies CA-5 wherever the authorizing agency or contract also cites the NIST baseline.
Who is responsible for writing the plan of action and milestones?
The organization owns the POA&M. Under SP 800-37 Rev. 2, the authorizing official approves the plan, but the content comes from the people who develop and implement remediation, which CA-5 assessment objects identify as organizational personnel with plan development responsibilities. Security, system owners and engineering teams usually supply the weakness descriptions, planned actions and milestones, while the security office maintains the document. Ask your team to name a single accountable owner for each open item so updates do not stall between assessments.
Can an implementation partner prepare the plan of action and milestones?
Yes, an implementation partner can help prepare the POA&M, including organizing findings from assessments, drafting remediation actions and building the tracking records the organization maintains. DeployOpen prepares systems, controls and evidence for assessments, but the organization owns its controls, approves the plan and decides what risk to accept. An assessor or authorizing official then reviews the result. Scope this work in writing, stating which findings the partner will document, which remediation work is included, and who signs off on each milestone.
Does an assessor approve the plan of action and milestones?
No. An independent assessor examines the POA&M to judge whether it reflects the findings in the assessment report and whether the planned remediation is credible, but approval belongs to the authorizing official under SP 800-37 Rev. 2. The assessor does not certify the plan or issue a report on it. Expect the assessor to compare each open weakness against the control assessment evidence and the plan's update history, so keep those records consistent with what the plan states.
What evidence keeps the plan of action and milestones current?
The plan stays current when each entry links to evidence that changed it: control assessment reports, independent audit or review results, continuous monitoring output such as scan results, and records showing a remediation was completed and verified. Common evidence includes ticket histories, change records, re-scan outputs and dated updates to the plan itself. Ask your team how often the plan is refreshed against each source, because CA-5 requires updates at a defined frequency that your organization sets and documents.
Can open-source tools track POA&M items?
Open-source tools can hold POA&M records, link findings to scanner output and produce versioned exports, but no tool guarantees that a plan satisfies CA-5. Confirm with the vendor or project whether a tool can store the fields your authorizing official expects and export them in the format your reviewers use, such as OSCAL. DeployOpen can plan and implement self-hosted platforms in your infrastructure for this tracking, and the choice of tool should follow your required fields and evidence trail.
How DeployOpen prepares POA&M evidence for assessment
DeployOpen's role in a POA&M effort is an implementation partner's role: it helps define the system boundary for the plan, organizes findings from control assessments, vulnerability scans and continuous monitoring into a tracked plan, prepares remediation evidence and hands over the documentation. The work is delivered under a fixed scope, with the systems, findings to be covered, deliverables and timelines agreed in writing before work starts. The organization remains the owner of its controls and of every POA&M entry, and it is the organization's own decision-makers who approve the plan and accept the risk it describes. DeployOpen does not issue assessment reports, authorizations or attestations; only an independent assessor, auditor or authorizing official does that, and no outcome of the plan is guaranteed by the engagement.
In practice, the preparation work centers on the entries a reviewer will test. Each weakness needs a documented source, a responsible owner, planned remediation steps, milestone dates and a status that matches the evidence on file. DeployOpen can help the organization set up a consistent record structure, so that an entry traces back to the assessment finding or monitoring result that created it, and so that closure is supported by something a reviewer can examine, such as a rescanned result, a configuration export or a change record. Where the organization uses open-source tools for tracking or machine-readable records, the structure can be aligned with OSCAL so the plan can be exchanged with other documents. Ask the partner which record format and tracker will be used and who keeps them current after handover.
Before you commit to a scope, confirm several points with the organization's authorizing official and its assessor. Ask which baseline applies to the system, which assessment findings the assessor expects to see in the plan, what update frequency the organization has defined for CA-5, and whether the authorization package in use has its own format or required fields. Also confirm whether the system is subject to FedRAMP, because FedRAMP handles weaknesses through its own rules rather than through CA-5. A useful written scope names the in-scope system components, the sources of findings, the people who approve entries and the documents handed over at the end, so that the organization can judge whether the work matches what its assessor will test.
