a. Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system; and
b. Update existing plan of action and milestones [Assignment: organization-defined frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.
In a space context, a POA&M should address software or firmware fixes and potential hardware or design rework when critical vulnerabilities surface. Because on-orbit maintenance windows are limited or sometimes impossible, teams need a realistic timeline for testing patches offline (via simulation or digital twin) before attempting any upload. The POA&M should also outline contingency measures (e.g., activating redundant subsystems) if a permanent fix is not feasible. This careful scheduling helps the program office and operators mitigate risk effectively while keeping the spacecraft’s operational tempo on track.
Assessment and authorization (A&A) is a structured, formal process through which an organization evaluates the extent to which a system's design and implementation satisfy a defined set of security requirements, and grants or denies authorization for that system to operate based on the assessed risk. For space mission systems, A&A may apply to spacecraft, ground systems, mission networks, supporting infrastructure, common controls, and the interfaces and dependencies among them. The authorization scope and boundary must be defined by the governing risk management framework, mission architecture, information types, applicable requirements, and organizational risk decisions. The assessment phase produces evidence concerning whether selected controls are implemented correctly, operating as intended, and producing the required security outcomes. The resulting authorization package should contain the system security plan, assessment reports, plan of action and milestones, executive risk summary, and other evidence required by the authorizing authority. The authorization decision, made by a designated authority with accountability for accepting the residual risk of operating the system, formally records the organization's acceptance of that risk and establishes the conditions under which the system may operate. Authorization must be supported throughout the system lifecycle by continuous monitoring, security impact analysis, updated risk information, and maintenance of the authorization evidence. Proposed system changes must be assessed before implementation when they could affect the authorization boundary, control implementation, or accepted risk. Significant changes or material deviations from the authorization basis must be reported to the authorizing authority, who determines whether additional assessment, modified authorization conditions, or reauthorization is required.
The verifiable process should also include a cross reference to mission objectives and impact statements. Understanding the flaws discovered and how they correlate to mission objectives will aid in prioritization.
SPR-266
The [organization] shall determine the vulnerabilities/weaknesses that require remediation, and coordinate the timeline for that remediation, in accordance with the analysis of the vulnerability scan report, the mission assessment of risk, and mission needs.{SV-SP-1,SV-SP-2,SV-SP-3,SV-SP-6,SV-SP-7,SV-SP-9,SV-SP-11}{CA-5,CM-3,RA-5,RA-7,SI-3,SI-3(10)}
Not all vulnerabilities carry equal mission impact. Risk-informed prioritization ensures critical flaws are addressed first. Coordinated timelines balance mission needs with security posture. Structured remediation strengthens governance.
SPR-277
In coordination with [organization], the [organization] shall prioritize and remediate flaws identified during security testing/evaluation.{SV-SP-1,SV-SP-3}{CA-2,CA-5,SA-11,SI-3,SI-3(10)}
Timely remediation reduces exploitation window. Coordination ensures mission continuity during patching. Documented prioritization demonstrates due diligence. Structured response enhances accountability.
SPR-380
The [organization] shall maintain an up-to-date Plan of Action and Milestones (POA&M) that identifies, assesses, prioritizes, and documents specific actions to be taken to correct deficiencies in the spacecraft's security posture.{SV-DCO-1}{CA-5}
A living POA&M tracks remediation progress. Structured prioritization reduces overlooked deficiencies. Documentation ensures accountability. Transparent tracking strengthens governance.