foxxcyber/docsThe Roadmap (POA&M)
Plan remediation as roadmap items grouped by quarter, linked to the risks, goals and controls they move, with cost, effort and the gaps still without a plan.
The Roadmap tab is the client's plan of action and milestones, in plain words: what gets done, by whom, by when, at what cost, and which risk or control it moves.
Roadmap items
Add item opens a new one. Each item gets a reference (RM-001) and
these fields, saved with Save item:
| Field | Notes |
|---|---|
| Title, Description | What will be done. |
| Type | Quick win, project, policy, training, tooling, process or vendor. |
| Priority | Critical, high, medium or low. |
| Status | Planned, in progress, blocked, done or dropped. |
| Owner, Start, Due, Completed on | Who, and when. |
| Cost estimate (in US dollars) and Effort | Effort in hours, days, weeks or months. |
| Treats risk | The risk from the register it reduces. |
| Supports goal | The business goal it serves. |
| Controls | The framework controls it moves. Use Find controls to search the client's adopted frameworks. |
How the tab is laid out
Four tiles head the tab: Open items, Overdue, Gaps without a plan and Planned spend (the sum of open items' estimates). Under them, chips pick one of three views, each with its count:
- Open items, grouped by quarter, with anything past its due date grouped under Overdue first. Each group shows its item count and planned cost.
- Gaps without a plan: controls assessed as not implemented or partial that have no open roadmap item yet. Plan it on each one starts an item linked to that control.
- Done and dropped items, kept for the record.
The client overview shows the next 90 days of roadmap work, the portfolio counts open and overdue items per client, and the board report shows the next six months.
Where roadmap items come from
- A control page: Plan remediation on a control assessed as not implemented or partial starts an item linked to that control.
- Gaps without a plan on this tab (Plan it).
- A finding in an issued assessment: Plan this on a finding a partner firm issued starts an item linked to that control. The form says "Planned from issued assessment vN", and the item keeps its link to that version. See Issuing an Assessment.
- A spreadsheet: an existing POA&M imports through the usual preview;
roadmap rows can name a risk (
R-012) and controls, for exampleCSF 2.0 PR.AA-01; CMMC L2 AC.L2-3.1.1. See Import and Export.
Items with a due date appear in Monitoring as they come due.
The roadmap and the formal plan document
For CMMC Level 2 clients, the roadmap is the working copy of the plan. The CMMC Level 2 additions starter set adds a "Plan of Action and Milestones" document to the library, so the client's formal, approved POA&M has its own versions and approvals. The eMASS export uses open roadmap items to fill in "Requirement in POA&M".