What does M-02-01 cover?

• A. Guidance for Preparing and Submitting Security Plans of Action and Milestones
• B. Reporting Instructions for the Federal Information Security Management Act
• C. PII Privacy Guidance for Agencies
• D. E-Authentication Policies for Federal Agencies

Answer: (A)

The main idea being tested is what OMB Memorandum M-02-01 addresses. It establishes a formal process for documenting and tracking the remediation of information security weaknesses through Security Plans of Action and Milestones (POA&M). Agencies are guided to prepare, maintain, and submit POA&Ms that list identified vulnerabilities, planned corrective actions, milestones, required resources, responsible officials, and current status, ensuring ongoing visibility and accountability for remediation efforts. This focus on documenting and reporting how security weaknesses will be fixed makes it the correct match. Other topics like general FISMA reporting, privacy guidance, or e-authentication policies are governed by different memoranda and are not the focus of M-02-01.