PM-4: Plan Of Action And Milestones Process
Generated
2019-04-12 13:01:48.067729
Status
Statements
The organization:
| Code | Description |
|---|---|
| PM-4a. | Implements a process for ensuring that plans of action and milestones for the security program and associated organizational information systems: |
| PM-4a.1. | Are developed and maintained; |
| PM-4a.2. | Document the remedial information security actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and |
| PM-4a.3. | Are reported in accordance with OMB FISMA reporting requirements. |
| PM-4b. | Reviews plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions. |
Additional Guidance
The plan of action and milestones is a key document in the information security program and is subject to federal reporting requirements established by OMB. With the increasing emphasis on organization-wide risk management across all three tiers in the risk management hierarchy (i.e., organization, mission/business process, and information system), organizations view plans of action and milestones from an organizational perspective, prioritizing risk response actions and ensuring consistency with the goals and objectives of the organization. Plan of action and milestones updates are based on findings from security control assessments and continuous monitoring activities. OMB FISMA reporting guidance contains instructions regarding organizational plans of action and milestones.