Assessment Objective

Determine if:

• a plan of action and milestones for the system is developed to document the planned remediation actions for correcting weaknesses or deficiencies noted during security assessments.
• a plan of action and milestones for the system is developed to reduce or eliminate known system vulnerabilities.
• the existing plan of action and milestones is updated based on the findings from security assessments.
• the existing plan of action and milestones is updated based on the findings from continuous monitoring activities.
• the existing plan of action and milestones is updated based on the findings from audits or reviews.

Assessment Methods

Examine

• security assessment and monitoring policy and procedures
• procedures for plans of action and milestones
• security assessment plan
• security assessment report
• security assessment evidence
• plan of action and milestones
• system security plan
• other relevant documents or records

Interview

• personnel with plans of action and milestones development and implementation responsibilities
• personnel with information security responsibilities

Test

• mechanisms for developing, implementing, and maintaining plans of action and milestones

Propojené úkoly

• NIST -

  https://csrc.nist.gov/pubs/sp/800/53/r5/upd1/final