NIST 800-171 3.12.2 (CA.L2-3.12.2): Plans of Action

What 3.12.2 means in practice

Every deficiency or vulnerability that is not fixed right away goes into a plan of action stating what will be done, by whom and by when, and the plan is carried out. Under the DoD Assessment Methodology a plan of action does not make a requirement that was never implemented count as met, and any unmet requirement without a plan of action makes 3.12.2 itself not met.

SPRS points and the CMMC POA&M

What an assessor checks for 3.12.2

NIST SP 800-171A gives 3 determination statements for 3.12.2, each found satisfied or other than satisfied. Determine if:

1. 3.12.2[a] deficiencies and vulnerabilities to be addressed by the plan of action are identified.
2. 3.12.2[b] a plan of action is developed to correct identified deficiencies and reduce or eliminate identified vulnerabilities.
3. 3.12.2[c] the plan of action is implemented to correct identified deficiencies and reduce or eliminate identified vulnerabilities.

NIST SP 800-171A (June 2018), assessment objectives for 3.12.2

Evidence that shows 3.12.2 is met

• The current plan of action listing each deficiency, the corrective action, the owner and the due date.
• Status updates showing items completed or rescheduled.
• A cross-check showing every unmet requirement has a plan of action item.

How PolicyCortex gathers the evidence

No PolicyCortex collector reads the evidence for 3.12.2. Your team provides the evidence listed above.