---

id: "CA-05" title: "Plan of Action and Milestones" family: "CA" family_name: "Assessment, Authorization, and Monitoring" sort_id: "ca-05" priority: "P1" implementation_level: "organization" enhancements: - ca-5.1

---

Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system; and

Update existing plan of action and milestones {{ insert: param, ca-05_odp }} based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.

Guidance

Plans of action and milestones are useful for any type of organization to track planned remedial actions. Plans of action and milestones are required in authorization packages and subject to federal reporting requirements established by OMB.

Assessment Objective: a plan of action and milestones for the system is developed to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system;

Assessment Objective: existing plan of action and milestones are updated {{ insert: param, ca-05_odp }} based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.

Assessment, authorization, and monitoring policy

procedures addressing plan of action and milestones

control assessment plan

control assessment report

control assessment evidence

plan of action and milestones

system security plan

privacy plan

other relevant documents or records

Organizational personnel with plan of action and milestones development and implementation responsibilities

organizational personnel with information security and privacy responsibilities

Mechanisms for developing, implementing, and maintaining plan of action and milestones