TE P A010 Plan of Action and Milestones (POAM).docx

DATA ITEM DESCRIPTION

Form Approved OMB No. 0704-0188

The public reporting burden for this collection of information is estimated to average 110 hours per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing the collection of information. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing the burden, to Department of Defense, Washington Headquarters Services, Directorate for Information Operations and Reports (0704-0188), 1215 Jefferson Davis Highway, Suite 1204, Arlington, VA 22202-4302. Respondents should be aware that notwithstanding any other provision of law, no person shall be subject to any penalty for failing to comply with a collection of information if it does not display a currently valid OMB control number. PLEASE DO NOT RETURN YOUR FORM TO THE ABOVE ADDRESS.

1. TITLE

A010 - TEN, Plan of Action and Milestones (POAM)

2. IDENTIFICATION NUMBER

3. DESCRIPTION/PURPOSE

This narrative provides the requirements for creating, maintaining, and closing system POAMs.

4. APPROVAL DATE

(YYYYMMDD)

5. OFFICE OF PRIMARY RESPONSIBILITY (OPR)

USAOTC FSTD-AMDTD

7. APPLICATION/INTERRELATIONSHIP

The Defense Information Systems Agency (DISA) publishes quarterly Security Technical Implementation Guide (STIG), which define DoD cyber-security requirements. A POAM is required when the organization cannot achieve near-term compliance with new standards in a STIG. The POAM is a plan of action that lays out how and when the organization will get into compliance. There is no limit to the number of POAMs an organization can have. The management of POAMs is performed in the Enterprise Mission Assurance Support Service (eMASS), which is on the Secret Internet Protocol Router Network (SIPRNet). The contractor must have authorized access to the SIPRNet and have an established eMASS account. The contractor must analyze the new STIG(s), establish POAMs as required, update the current status of all active POAMs, and close out POAMs that are complete (the organization has achieved compliance). There are two monthly deliverables: a) a monthly report of POAMs to the System Owner (Chief, Test Support Division) NLT the 23d day of the month, and b) a running total of active monthly POAMs over a rolling 12 month period, showing active POAMs over time. Both deliverables can be in different tabs of the same Excel file.

10. PREPARATION INSTRUCTIONS

The deliverable will consist of an Excel spreadsheet with the POAMs listed in rows from oldest to newest. Columns will be organized as follows:

Column A POAM Name or reference number Column B New Column C Active Column D Closed Column E Comments

The second deliverable will be a monthly running total of active POAMs in an Excel spreadsheet.

Column A the Month Column B the number of active POAMs

For example Month Active POAMs Apr 20 Mar 19 Feb 17 Jan 25 Dec 22 So on for 12 months (most current month at the top)

11. DISTRIBUTION STATEMENT

DD FORM 1664, AUG 96 (EG)

PREVIOUS EDITION MAY BE USED.

Page of Pages Designed using Perform Pro, WHS/DIOR, Aug 96