A fixed-price gap analysis, remediation through to your audit, and upkeep after it. All in a workspace you keep.
All compliance →Led by a published security researcher with five CVEs. One standard report, letters for your buyers, and retests of your fixes.
All security →To the people you sell to, raise from or answer to.
All industries →Original research, free tools, and plain-language guides on security and compliance, from a published security researcher.
Read the blog →A Plan of Action and Milestones, usually shortened to POA&M, is a tracked record of security requirements that are not yet met, each with a named owner, a planned remediation and a target completion date. It sits alongside the System Security Plan.
The POA&M is a live document rather than a submission artefact. Items close, new ones open when the environment changes, and an assessor comparing this year's to last year's will notice if the same entries have simply had their dates pushed.
The most common weakness is vagueness. "Improve logging" with an owner of "IT" and a date of "Q4" tells nobody anything. "Enable CloudTrail in the two remaining regions, owner J. Smith, 30 November" can be verified.
traztech delivers Compliance readiness including the SSP and POA&M for startups and growth-stage companies, led by a published security researcher.
Book a callFor a broader look at getting audit-ready, see our SOC 2 readiness work, or talk to a fractional CISO about building a program around it.
Free PDFs, no card
SOC 2 readiness, ISO 27001 gaps, incident response and vendor security, as PDFs you can print or forward. Free, no card.
From Jacob Masse, principal of traztech: the files by email, then a few short notes over the next month. No spam, unsubscribe in one click.
A POA&M is how you carry an unmet requirement without failing. It records what is not in place, who owns it, what the fix is and when it lands.
Assessors read the POA&M alongside the System Security Plan. The SSP says how each requirement is met; the POA&M covers the ones that are not yet. Dates that have already passed are the fastest way to lose credibility with an assessor.
No. Every real program has open items. What matters is that each has a named owner, a specific remediation and a date that has not already gone by.
Not by that name. ISO 27001 uses a risk treatment plan and SOC 2 relies on management responses to findings, but the substance is the same: a tracked list of gaps with owners and dates.
The honest test is whether the date is real and whether it moves each time somebody looks.