Free compliance framework explorer — browse controls, evidence, and implementation guidance.Subscribe for updates →
SOC 247
ITSP.10.17198
ISO 42001soon
ISO 27001soon

Browse

98 controls

03.12.02Plan of action and milestonesITSP.10.171Security assessment and monitoring

Official Requirement

A. Develop a plan of action and milestones (POAMs) for the system to: 1. document the planned remediation actions to correct weaknesses or deficiencies noted during security assessments 2. reduce or eliminate known system vulnerabilities B. Update the existing POAMs based on the findings from: 1. security assessments 2. audits or reviews 3. continuous monitoring activities

Source: Canadian Centre for Cyber Security ITSP.10.171 (2025), adapted from NIST SP 800-171 Rev. 3

In Plain English

When security assessments or audits identify weaknesses, you must create formal plans of action and milestones (POAMs) that document what will be fixed, who is responsible, and when it will be completed. POAMs must be kept current based on new findings from ongoing assessments and monitoring.

Cross-framework mappings:ISO 42001 · coming soonISO 27001 · coming soon
View in Map →

Help us build what matters.

Vote for the next framework, subscribe for updates, and let us know if you'd contribute.

Truvo CyberTruvo CyberBuilt and maintained by Truvo Cyber
Authors·Connect with us
Updated: Mar 22, 2026Reviewed: Mar 22, 2026v1.0.0
Share this tool

The Trust Services Criteria referenced in this tool are published by the American Institute of Certified Public Accountants (AICPA) and incorporate principles from the Committee of Sponsoring Organizations of the Treadway Commission (COSO). Criteria descriptions are reproduced for reference purposes. All implementation guidance, evidence recommendations, and control language are original work by Truvo Cyber. ISO 27001 and ISO 42001 are standards published by the International Organization for Standardization (ISO). Framework and standard names are the property of their respective owners. This tool is not affiliated with, endorsed by, or certified by AICPA, COSO, or ISO.

© 2026 Truvo Cyber. All rights reserved.

On-premises implementation and evidence

Plan of action and milestones management

Implementation steps

  1. Develop POAMs for all weaknesses and deficiencies identified through security assessments, audits, and monitoring
  2. Document planned remediation actions, responsible individuals, required resources, milestones, and estimated completion dates
  3. Update POAMs when new findings are identified from assessments, audits, or continuous monitoring activities
  4. Conduct regular management reviews of POAM progress and adjust timelines and resources as necessary

Tools / systems

Evidence artifacts

Evidence frequency: Per-event POAM creation; monthly or quarterly POAM reviews; continuous updates from monitoring