oscal-poam

OSCAL Plan of Action and Milestones (POA&M) Model

The POA&M model tracks identified weaknesses and the planned remediation activities. It documents how and when risks will be addressed.

Related skills:

• oscal-assessment-results - Findings that generate POA&M entries
• oscal-ssp - System with identified weaknesses

Purpose

A POA&M:

• Tracks remediation of identified weaknesses
• Documents milestones for remediation activities
• Records risk decisions (accept, mitigate, transfer)
• Supports authorization maintenance
• Provides visibility into security posture improvements

Document Structure

plan-of-action-and-milestones:
  uuid: <unique-identifier>
  metadata:
    title: "System POA&M"
    version: "1.0.0"
    oscal-version: "1.1.2"
  import-ssp:
    href: "ssp.json"
  system-id:
    identifier-type: https://fedramp.gov
    id: "F1234567890"
  local-definitions: {}
  observations: []
  risks: []
  findings: []
  poam-items: []
  back-matter:
    resources: []

Import SSP

Reference the system's SSP:

import-ssp:
  href: "https://example.com/system-ssp.json"

POA&M Items

The core tracking element:

poam-items:
  - uuid: poam-item-uuid
    title: "Password Complexity Remediation"
    description: "Implement stronger password requirements"
    props:
      - name: poam-id
        value: "V-2024-001"
      - name: priority
        value: high
    origins:
      - actors:
          - type: party
            actor-uuid: assessor-uuid
            role-id: assessor
    related-findings:
      - finding-uuid: finding-uuid
    related-observations:
      - observation-uuid: observation-uuid
    related-risks:
      - risk-uuid: risk-uuid
    remarks: "Scheduled for Q2 2024 implementation"

POA&M Item Properties

Common properties for tracking:

props:
  - name: poam-id
    value: "V-2024-001"
  - name: priority
    value: high
  - name: vendor-dependency
    value: "true"
  - name: deviation
    value: "operational-requirement"
  - name: planned-completion-date
    value: "2024-06-30"
  - name: original-detection-date
    value: "2024-03-10"
  - name: scheduled-completion-date
    value: "2024-06-30"
  - name: actual-completion-date
    value: "2024-05-15"