The Plan of Action and Milestones (POA&M) is a remedial action plan (the process of accepting or resolving a risk) which helps the agency to identify and assess information system security and privacy weaknesses, set priorities, and monitor progress toward mitigating the weaknesses.4 A