PM-4

PM-4 PLAN OF ACTION AND MILESTONES PROCESS

Overview

Number	Title	Impact	Priority	Subject Area
PM-4	Plan Of Action And Milestones Process			Program Management

Instructions
The organization: PM-4a. Implements a process for ensuring that plans of action and milestones for the security program and associated organizational information systems: PM-4a.1. Are developed and maintained; PM-4a.2. Document the remedial information security actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and PM-4a.3. Are reported in accordance with OMB FISMA reporting requirements. PM-4b. Reviews plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

Instructions

The organization:

PM-4a.

Implements a process for ensuring that plans of action and milestones for the security program and associated organizational information systems:

PM-4a.1.

Are developed and maintained;

PM-4a.2.

Document the remedial information security actions to adequately respond to risk to organizational operations and assets, individuals, other organizations, and the Nation; and

PM-4a.3.

Are reported in accordance with OMB FISMA reporting requirements.

PM-4b.

Reviews plans of action and milestones for consistency with the organizational risk management strategy and organization-wide priorities for risk response actions.

Guidance
The plan of action and milestones is a key document in the information security program and is subject to federal reporting requirements established by OMB. With the increasing emphasis on organization-wide risk management across all three tiers in the risk management hierarchy (i.e., organization, mission/business process, and information system), organizations view plans of action and milestones from an organizational perspective, prioritizing risk response actions and ensuring consistency with the goals and objectives of the organization. Plan of action and milestones updates are based on findings from security control assessments and continuous monitoring activities. OMB FISMA reporting guidance contains instructions regarding organizational plans of action and milestones.

Guidance

The plan of action and milestones is a key document in the information security program and is subject to federal reporting requirements established by OMB. With the increasing emphasis on organization-wide risk management across all three tiers in the risk management hierarchy (i.e., organization, mission/business process, and information system), organizations view plans of action and milestones from an organizational perspective, prioritizing risk response actions and ensuring consistency with the goals and objectives of the organization. Plan of action and milestones updates are based on findings from security control assessments and continuous monitoring activities. OMB FISMA reporting guidance contains instructions regarding organizational plans of action and milestones.

Enhancements