PM-4 Plan of Action and Milestones Process. Implement a process to ensure that plans of action and milestones for the information security, privacy, and supply chain risk management programs and associated organizational systems: Are developed
Plan of Action and Milestones Process. Implement a process to ensure that plans of action and milestones for the information security, privacy, and supply chain risk management programs and associated organizational syst.
system holds itEvidence a system already holds
none for this control
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- The process document for developing and maintaining plans of action and milestones across security, privacy and supply chain risk management · Policy repository / GRC workspace
- Current plans of action and milestones with the remedial actions, resources, milestones and completion dates · Policy repository / GRC workspace
- Evidence the plans are reported in accordance with the organisational reporting requirements · Policy repository / GRC workspace
- Review records checking the plans for consistency with the organisational risk management strategy and priorities · Policy repository / GRC workspace
- Evidence of a central view across all systems rather than plans held only by system owners · Policy repository / GRC workspace
First move
Common gaps auditors find
- Milestone dates extended repeatedly with no re-approval, so the plan never technically slips
- Plans maintained per system with no organisation-wide view, so common root causes are invisible
- Supply chain risk items excluded from the process despite being in scope of the control
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetPM-3 Information Security and Privacy Resources. Include the resources needed to implement the information security and privacy programs in capital planning and investment requests and document all exceptions to this requirement; Prepare documentation required for · PM-5 System Inventory. Develop and update [organization-defined] an inventory of organizational systems