What is a POAM?

• A. A document that identifies tasks needing to be accomplished.
• B. A plan for ongoing maintenance of software licenses.
• C. A description of the system's backup strategy.
• D. A formal risk acceptance memo.

Answer: (A)

A POAM is a Plan of Actions and Milestones. It’s a management document used to capture every action needed to remediate identified security weaknesses, and to track progress toward completing those actions. The value of a POAM lies in listing each remediation task, who is responsible, the resources required, milestones, and the current status, along with target completion dates. This creates a clear, auditable path from identifying a vulnerability to closing it, which is why describing it as a document that identifies tasks needing to be accomplished fits best.

The other ideas describe different kinds of plans not tied to remediation tasks: a plan for ongoing software license maintenance, a backup strategy, or a formal risk acceptance memo.