Lion Cipher Lab
Age and prioritize a POA&M backlog by risk and deadline
- GRC / Compliance
- Intermediate
- ~40 min
- Free · no account required
Why it matters
A Plan of Action and Milestones (POA&M) is the running record of known security weaknesses an organization has accepted it must fix, each with an owner and a target completion date. It is a core artifact of the NIST Risk Management Framework: once a system is authorized, the POA&M is how remaining weaknesses are tracked to closure. The trouble starts when the list grows. The most common way teams decide what to fix next is to sort by the due date or to work whatever status column is red. Both are wrong. A due-date sort will put a low-severity item due tomorrow ahead of a critical that was due…
What you'll learn
- what a POA&M is and where it comes from in the RMF
- aging open items against their milestone dates
- ranking a remediation backlog by risk and overdue age, not just by date
- showing stakeholders why a due-date sort buries the wrong work
- reporting overdue-critical count as a KRI
- the limits of a prioritization score
Steps in this lab
- What a POA&M is, and why a due-date sort fails it
- The backlog
- Write the aging-and-ranking script
- Run it: what a deadline sort buries
- From ranking to action, and the limits