PM-04 [P] Plan of Action and Milestones Process

Assessment Objective

Determine if:

PM-04a.
- PM-04a.01
  - PM-04a.01[01] a process to ensure that plans of action and milestones for the information security program and associated organizational systems are developed;
  - PM-04a.01[02] a process to ensure that plans of action and milestones for the information security program and associated organizational systems are maintained;
  - PM-04a.01[03] a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are developed;
  - PM-04a.01[04] a process to ensure that plans of action and milestones for the privacy program and associated organizational systems are maintained;
  - PM-04a.01[05] a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are developed;
  - PM-04a.01[06] a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems are maintained;
- PM-04a.02
  - PM-04a.02[01] a process to ensure that plans of action and milestones for the information security program and associated organizational systems document remedial information security risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
  - PM-04a.02[02] a process to ensure that plans of action and milestones for the privacy program and associated organizational systems document remedial privacy risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
  - PM-04a.02[03] a process to ensure that plans of action and milestones for the supply chain risk management program and associated organizational systems document remedial supply chain risk management actions to adequately respond to risks to organizational operations and assets, individuals, other organizations, and the Nation;
- PM-04a.03
  - PM-04a.03[01] a process to ensure that plans of action and milestones for the information security risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
  - PM-04a.03[02] a process to ensure that plans of action and milestones for the privacy risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
  - PM-04a.03[03] a process to ensure that plans of action and milestones for the supply chain risk management programs and associated organizational systems are reported in accordance with established reporting requirements;
PM-04b.
- PM-04b.[01] plans of action and milestones are reviewed for consistency with the organizational risk management strategy;
- PM-04b.[02] plans of action and milestones are reviewed for consistency with organization-wide priorities for risk response actions.

Assessment Methods

Examine

Information security program plan
plans of action and milestones
procedures addressing plans of action and milestones development and maintenance
procedures addressing plans of action and milestones reporting
procedures for reviewing plans of action and milestones for consistency with risk management strategy and risk response priorities
results of risk assessments associated with plans of action and milestones
OMB FISMA reporting requirements
other relevant documents or records

Interview

Organizational personnel with responsibilities for developing, maintaining, reviewing, and reporting plans of action and milestones
organizational personnel with information security responsibilities

Test

Organizational processes for plan of action and milestones development, review, maintenance, and reporting
mechanisms supporting plans of action and milestones

Linkede sager

Sagslinks
Linktype	Sag
blocks	PM-04 [P] Plan of Action and Milestones Process

NIST -
EN: Publications of the National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, from their electronic versions (OSCAL; SP 800-63-4 from its HTML version, https://pages.nist.gov/800-63-4/). Works of NIST employees are not subject to copyright protection in the United States (17 U.S.C. § 105); the OSCAL content is dedicated to the public domain worldwide (CC0 1.0); outside the United States NIST grants the right to reprint its technical series publications in all formats (NIST copyright statement). Republished courtesy of the National Institute of Standards and Technology; each document names its citation. Divided into sections and converted into the GRCA format, the wording unchanged. Only the versions published by NIST are authoritative.

DE: Veröffentlichungen des National Institute of Standards and Technology (NIST), U.S. Department of Commerce, https://www.nist.gov/, aus ihren elektronischen Fassungen (OSCAL; SP 800-63-4 aus ihrer HTML-Fassung, https://pages.nist.gov/800-63-4/). Werke von NIST-Beschäftigten sind in den USA urheberrechtlich nicht geschützt (17 U.S.C. § 105); die OSCAL-Inhalte sind weltweit gemeinfrei gestellt (CC0 1.0); außerhalb der USA räumt das NIST das Recht ein, seine Technical-Series-Publikationen in allen Formaten neu zu veröffentlichen (Copyright-Hinweis des NIST). „Republished courtesy of the National Institute of Standards and Technology“; jedes Dokument nennt seine Zitierangabe. In Abschnitte aufgeteilt und in das GRCA-Format umgewandelt, der Wortlaut unverändert. Maßgeblich sind allein die vom NIST veröffentlichten Fassungen.