PM-4: Plan of Action and Milestones Process

Quick-reference card

What this control requires

PM-04 requires your organization to establish and maintain a structured process for developing, updating, and reporting plans of action and milestones (POA&Ms) across information security, privacy, and supply chain risk management programs. This isn’t about creating a single remediation document. It’s the organizational process that governs how every POA&M gets built, tracked, and reported up the chain.

In practice, this process ensures that remedial actions are documented with enough specificity to address identified risks, and that progress reporting meets established requirements, including OMB FISMA mandates for federal agencies. Without a defined POA&M process, remediation tracking becomes ad hoc, and leadership loses visibility into which risks are actually being addressed versus which ones are sitting in a spreadsheet no one owns.

The control also requires periodic review of POA&Ms for alignment with the organization’s risk management strategy and enterprise-wide priorities. That review step matters because remediation plans created in isolation tend to drift from organizational risk tolerances. A vulnerability that warrants immediate attention in one business context might be deprioritized in another, and the POA&M process is where those trade-offs get formalized and documented. NIST SP 800-53 treats this as a program management function, distinct from the system-level POA&M document itself. That system-level document falls under CA-5.

Why it matters

Most organizations have some form of remediation tracking. The problem is that tracking alone doesn’t satisfy PM-04. What auditors look for is an institutionalized process with defined inputs, reporting cadences, and executive review, not a collection of disconnected remediation lists scattered across teams.

Failure to maintain this control introduces audit risk during FISMA reporting cycles, privacy program assessments, and supply chain risk reviews. When an assessor asks for evidence that POA&Ms are reported in accordance with established requirements and you can’t point to a documented process, the finding lands on your organization regardless of how many issues you’ve actually remediated.

The risk compounds over time. Without a formal process, remediation items accumulate without prioritization, stale entries obscure genuine progress, and leadership can’t distinguish between acceptable residual risk and unaddressed vulnerabilities. This gap becomes visible during continuous monitoring activities, where outdated POA&Ms signal a breakdown in program governance.

Specifically, the absence of POA&M process discipline creates misalignment between system-level remediation efforts and organization-wide risk priorities. Teams remediate what’s in front of them rather than what matters most to the enterprise, which means resources get allocated to low-impact fixes while high-priority risks remain open.

What attackers exploit:

• Stale or abandoned POA&M entries that mask unresolved vulnerabilities, leaving known weaknesses unpatched for months or years
• Lack of prioritization in remediation tracking, allowing critical risks to be deprioritized beneath high-volume, low-impact items
• Disconnected POA&Ms across programs (security, privacy, supply chain) that create blind spots where cross-cutting risks go untracked
• Absence of executive review, which means no one with authority is validating whether the remediation strategy aligns with actual threat exposure
• Missing reporting cadences that prevent timely escalation of risks requiring leadership decisions

How to implement

For your organization

The most common failure mode isn’t a missing POA&M process. It’s a process that exists on paper but doesn’t connect to how remediation actually happens. Teams create POA&Ms during audit prep, then abandon them until the next assessment cycle. Closing this gap requires treating the POA&M process as a living governance function, not an audit artifact.

Step 1: Define the POA&M lifecycle. Document how POA&Ms are initiated, who owns them, how remediation actions are tracked, and what triggers closure. Cover all three program areas: information security, privacy, and supply chain risk management. Specify the criteria for when a finding becomes a POA&M entry versus when it’s resolved in place.

Step 2: Establish reporting requirements. Identify your reporting obligations. For federal organizations, this means aligning with OMB FISMA reporting requirements. For other organizations, define internal reporting cadences that match your risk governance structure. Document who receives POA&M status reports, how often, and in what format.

Step 3: Assign ownership at multiple levels. POA&Ms can exist at system, mission/business process, and organizational levels. Each level needs a designated owner responsible for maintaining accuracy and driving remediation. Without clear ownership, POA&M entries become orphaned.

Step 4: Build in prioritization. Connect your POA&M process to your risk management strategy. Each entry should reference the underlying risk assessment, and prioritization should reflect organization-wide risk response priorities, not just the severity score from the originating assessment. This is where PM-04 intersects with risk response planning.

Step 5: Implement periodic review cycles. Schedule reviews to verify that POA&Ms remain consistent with your risk management strategy. Look for entries that have been open beyond their target completion date, entries whose risk context has changed, and entries that no longer align with current organizational priorities.

Common mistakes to avoid:

• Treating POA&Ms as static audit artifacts rather than active remediation trackers
• Failing to distinguish between the POA&M process (PM-04) and individual system-level POA&M documents (CA-5)
• Not connecting POA&M entries back to the risk assessments that generated them
• Omitting supply chain risk management findings from the POA&M process
• Reporting POA&M status without executive review for strategic alignment

Evidence examples

Cross-framework mapping

Related controls

• CA-05 — Plan of Action and Milestones: CA-5 is the system-level POA&M document itself, while PM-04 governs the organization-wide process for managing all POA&Ms across programs.
• CA-07 — Continuous Monitoring: Continuous monitoring generates the findings and assessment results that feed into POA&M entries, making these two controls operationally linked.
• PM-03 — Information Security and Privacy Resources: Resource allocation decisions directly affect whether POA&M remediation targets can be met on schedule.
• RA-07 — Risk Response: POA&M prioritization must align with the organization’s risk response strategy, which RA-07 defines.
• SI-12 — Information Management and Retention: Retention policies govern how long POA&M records and associated evidence must be maintained for audit and reporting purposes.

Frequently asked questions

What is NIST SP 800-53 PM-04?

PM-04 establishes the organization-wide process for developing, maintaining, and reporting plans of action and milestones across information security, privacy, and supply chain risk management programs. It requires that POA&Ms document specific remedial actions to address identified risks and that reporting follows established requirements, including OMB FISMA mandates for federal agencies. The control also mandates periodic review of POA&Ms to verify alignment with the organizational risk management strategy.

What happens if PM-04 is not implemented?

Without a formalized POA&M process, your organization loses the ability to demonstrate systematic remediation tracking during audits and FISMA reporting cycles. Remediation items accumulate without prioritization, and assessors will flag the absence of documented procedures for POA&M development and maintenance as a finding. Over time, the disconnect between risk assessments and remediation activities grows, making it harder to justify resource allocation decisions to leadership.

How do you audit PM-04?

Auditors verify that POA&M processes for information security, privacy, and supply chain programs are documented, actively maintained, and producing results consistent with the organization’s risk management strategy. They’ll request evidence of established reporting cadences, review the POA&M records themselves for completeness of remedial actions, and check that periodic reviews have been conducted to ensure organization-wide risk response priorities are reflected. Expect assessors to compare POA&M entries against recent risk assessment results to confirm that findings are flowing into the remediation process.

What is the difference between PM-04 and CA-5?

PM-04 defines the organizational process that governs how all POA&Ms are created, tracked, reported, and reviewed for strategic alignment. CA-5 operates at the system level, requiring that individual systems maintain their own POA&M documents. Think of PM-04 as the governance framework and CA-5 as one output of that framework. An organization can have a well-maintained system-level POA&M under CA-5 but still fail PM-04 if there’s no overarching process ensuring consistency, reporting compliance, and executive review across all programs.