What is the role of POAM in C&A?

• A. It lists vulnerabilities and planned mitigations and is used by GAO to assess risk reduction
• B. It is a training schedule
• C. It is a vendor contract
• D. It is a disaster recovery plan

Answer: (A)

POAM in the Certification and Accreditation process is the Plan of Actions and Milestones. It’s the living record that lists every identified security vulnerability, the specific actions planned to fix each one, who is responsible, the target completion dates, and the current status. The main purpose is to show how the organization is actively reducing risk over time by implementing these mitigations. This is exactly why oversight bodies like the GAO use the POAM to assess whether risk reduction is actually happening and how effectively remedial actions are progressing.

The choice you’d want here isn’t a training schedule, a vendor contract, or a disaster recovery plan, because those documents serve different functions. A training schedule organizes learning for staff, a vendor contract formalizes procurement, and a disaster recovery plan describes how to recover operations after a disruption. The POAM specifically ties vulnerabilities to concrete actions and milestones aimed at reducing risk.