Plan of action and milestones
Also known as POA&M
A documented plan for closing known compliance gaps, with owners and target dates.
Frameworks accept that not everything can be fixed at once. A POA&M records what is not yet met, what will be done about it, who owns it, and when it will be complete.
It only works as evidence if the dates are met or formally revised. A plan full of targets that quietly passed is worse than no plan, because it demonstrates the process is not real.
Where this comes up
Plan of action and milestones sits inside our compliance and frameworks work. If you are trying to work out what this means for your own environment rather than in the abstract, that is the page worth reading next, and a short call will get you a straight answer faster than either.