Question 40.

For the Designated Network, submit a copy of the most recent security Plan of Action and Milestones (POA&M) (or equivalent) showing appropriate mitigation efforts in response to moderate and high findings of the most recent security assessment and/or technical audit. If the POA&M contains IP addresses or any other identifiable information that is considered confidential or of a sensitive nature, for example, a host name and the specific vulnerability associated with that host name, please redact such information. If you do not have evidence of the most recent security POA&M (or equivalent) at the time of application, please address in the project plan required in Part VI of this application how you will fulfill this obligation prior to conformance testing.