FedRAMP High CA-5: Plan of Action and Milestones

What else in your programme already covers this

This control maps to 47 controls across 30 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.

Cloud Security Alliance Cloud Controls Matrix (CCM) v4.0.1 · 4 controls

CCM-A&A-06 Remediation
CCM-CCC-08 Exception Management
CCM-GRC-04 Policy Exception Process
CCM-TVM-09 Vulnerability Management Reporting

NIST Cybersecurity Framework 2.0 · 4 controls

NIST-CSF-GV.RM-07 Strategic opportunities (i.e., positive risks) are characterized and are included in organizational cybersecurity risk discussions
NIST-CSF-ID.IM-02 Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties
NIST-CSF-ID.RA-01 Vulnerabilities in assets are identified, validated, and recorded
NIST-CSF-ID.RA-06 Risk responses are chosen, prioritized, planned, tracked, and communicated

CFTC System Safeguards (17 CFR 37, 38, 39, 49) · 3 controls

CFTC-SS-2 Enterprise Risk Management and Governance Category
CFTC-SS-21 Remediation of Vulnerabilities and Deficiencies
CFTC-SS-36 Internal Reporting and Review by Senior Management and the Board

CIS Controls v8 · 3 controls

CIS-18.3 Remediate Penetration Test Findings
CIS-7.2 Establish and Maintain a Remediation Process
CIS-7.7 Remediate Detected Vulnerabilities

ISO/IEC 42001:2023 · 3 controls

10.2 Nonconformity and corrective action
6.1.3 Risk treatment
8.3 AI risk treatment

APRA CPS 234 · 2 controls

CPS234-28 Escalation of Unremediated Testing Deficiencies
CPS234-36 APRA Notification of Material Control Weakness within 10 Business Days

Australia Consumer Data Right - Banking (CDR) · 2 controls

AUCDR-IS-4 Formal vulnerability management program
AUCDR-IS-STEP4 Step 4 - Implement a formal controls assessment program

C5 (Germany) · 2 controls

C5-OPS-22 Testing and Documentation of known Vulnerabilities
C5-SP-03 Exceptions from Existing Policies and Instructions

DORA · 2 controls

DORA-Art.13 Learning and evolving
DORA-Art.50 Administrative penalties and remedial measures

ISO 22301:2019 · 2 controls

10.1 Nonconformity and corrective action
10.2 Continual improvement

ANSSI Guide d'hygiene informatique (42 mesures, v2.0) · 1 control

ANSSI-HYG-38 Carry Out Regular Security Checks and Audits and Apply the Corrective Actions

APRA CPS 220 Risk Management · 1 control

CPS220-P35 Required Content of Risk Management Policies and Procedures

APRA CPS 230 Operational Risk Management · 1 control

CPS230-P31 Remediation of Material Operational Risk Weaknesses

Azure Security Benchmark · 1 control

ASBv3-PV-6 Rapidly and automatically remediate vulnerabilities

CMMC 2.0 · 1 control

CA.L2-3.12.2 Plan of Action

GDPR · 1 control

GDPR-Art.24 Responsibility of the controller

HIPAA Security Rule · 1 control

164.308(a)(1)(ii)(B) Risk Management (Required)

ISO 27001:2022 · 1 control

5.36 Compliance with policies, rules and standards for information security

ISO 27002:2022 · 1 control

5.36 Compliance with policies, rules and standards for information security

ISO 27701:2019 · 1 control

5.6.3 Information security risk treatment

NIS2 Directive · 1 control

Art.21.4 Take corrective measures without undue delay on finding that the measures are not met

NIST SP 800-161 Rev 1 · 1 control

161R1-CA-5 Plan of Action and Milestones

NIST SP 800-171 Rev 3 · 1 control

03.12.02 Plan of Action and Milestones

NIST SP 800-171A - Assessing Security Requirements for Controlled Unclassified Information (CUI) · 1 control

171A-03.12.02 Plan of Action and Milestones

NIST SP 800-218 · 1 control

SP800-218-RV.2.2 Develop and Implement Remediation Plans

NIST SP 800-53 Rev 5 · 1 control

NIST800-CA-5 Plan of action and milestones

NIST SP 800-53A Rev. 5 · 1 control

53A-3.4 Analyze Assessment Report Results

NIST SP 800-66 Rev 2 · 1 control

164.308(a)(1)(ii)(B) Risk Management (Required)

PCI DSS 4.0 · 1 control

11.4.4 Pen test findings remediated

SOC 2 · 1 control

SOC2-CC4.2 COSO principle 17: Evaluates and communicates deficiencies in a timely manner

Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.