Plan of Action and Milestones

frameworkNIST SP 800-53 Rev 5.2 sectionCA Assessment, Authorization and Monitoring csf 2.0ID.IM-01 ID.IM-02 ID.IM-03 topics— frameworks2 0 11

Official texta. Develop a plan of action and milestones for the system to document the planned remediation actions of the organization to correct weaknesses or deficiencies noted during the assessment of the controls and to reduce or eliminate known vulnerabilities in the system; and
b. Update existing plan of action and milestones [Assignment: organization-defined frequency] based on the findings from control assessments, independent audits or reviews, and continuous monitoring activities.NIST SP 800-53 Rev 5.2 control statement (public domain)

gap from 800-53 → gap to 800-53 →

Wrong or missing mapping? Report it

Equivalents of CA-5 in other frameworks
Framework	Requirement	Title	Link	Source / reason
NIST CSF 2.0	—	No requirement	No mapping in our data	No mapping in our data.
ISO 27001	Clause 8.3 Clause 9.3.3 Clause 10.2	Information security risk treatment; Management review results…	Crosswalk	NIST SP 800-53 → ISO 27001 mapping
CIS v8.1	—	No requirement	No mapping in our data	No mapping in our data (most CIS links are editorial: CIS's published crosswalk covers 49 of 153 safeguards).
SOC 2	—	No requirement	No mapping in our data	No mapping in our data (SOC 2 links are editorial only).
PCI DSS	—	No requirement	No mapping in our data	No mapping in our data.
CMMC	CA.L2-3.12.1 CA.L2-3.12.2 CA.L2-3.12.3 CA.L2-3.12.4	Security Control Assessment; Plan of Action…	Crosswalk	NIST SP 800-171r2 Appendix D; NIST SP 800-171r3 03.12.02 → SP 800-53
HIPAA	—	No requirement	No mapping in our data	No mapping in our data.
GDPR	—	No requirement	No mapping in our data	No mapping in our data (only GDPR's security articles are mapped, editorially).
NIS2	—	No requirement	No mapping in our data	No mapping in our data.
Essential Eight	—	No requirement	No mapping in our data	No mapping in our data (Essential Eight links are editorial only).
DORA	—	No requirement	No mapping in our data	No mapping in our data (DORA links are editorial, and its technical standards are not mapped).
CPS 234	—	No requirement	No mapping in our data	No mapping in our data (CPS 234 is principles-based and its links are editorial).
Cyber Essentials	—	No requirement	No mapping in our data	No mapping in our data (Cyber Essentials covers five technical controls only).

Crosswalk a published crosswalk (NIST, ENISA, CIS, PCI SSC) makes the link · Editorial ControlMapping's judgement where no crosswalk exists; the reason is shown · Loosely related only shares a CSF 2.0 outcome: worth checking, not a mapping · No mapping in our data nothing mapped in our data; often new work, but check the coverage notes. How links are sourced.