By GAO told eight civilian agencies to require that risk assessments drive how they rank POA&M items. All eight recommendations are closed, and GAO's notes show the written rules it accepted, which is the standard a recompete evaluator will hold a contractor's ledger to.
In July 2019, GAO reported in Cybersecurity: Agencies Need to Fully Establish Risk Management Programs and Address Challenges (opens in a new tab) (GAO-19-384) that 17 of the 23 civilian agencies it reviewed had not fully established agency- and system-level policies for assessing, responding to, and monitoring risk. DoW (formerly DoD) was not part of the review.
Eight of those policy recommendations had a specific ask: require that risk assessments inform how the agency prioritizes its plans of action and milestones (POA&Ms). They went to USDA, Commerce, HUD, Labor, State, NASA, NRC, and SBA. All eight are now closed as implemented.
GAO's status notes date the closures from March 2020 (HUD and SBA) to September 2025 (Labor), a spread of more than five years. The report overall has 55 of 58 recommendations closed, and none of the three still open concerns POA&Ms.
A POA&M is the ledger of known weaknesses, and prioritization is the step where judgment enters. NIST SP 800-53 Rev. 5 control PM-4 (opens in a new tab) asks agencies to review their POA&Ms for consistency with the organizational risk management strategy and organization-wide priorities for risk response. An agency that has no written rule linking the two can leave each system owner to rank items alone.
The fix GAO accepted was a document. HUD updated its POA&M procedures, and SBA revised its risk management framework implementation procedures. NASA revised its IT Security Handbook, while Commerce updated its Security and Privacy Assessment and Authorization Handbook.
Commerce did not state whether it concurred; HUD, Labor, State, NASA, NRC, and SBA did. Labor provided updated policies in September 2025, six years after the report, and Commerce its handbook in February 2024. The notes describe policy text. They do not say how closely daily ranking follows it, which is where a contractor's work either matches the rule or doesn't.
A recompete for A&A or ISSO support will often hand the contractor a ledger that already exists. The evaluator wants to see how you will rank what is in it, and "highest severity first" is a weak answer when the agency's own handbook says risk, not scanner score, sets the order.
Name the agency's rule in the technical volume. Show the sort keys, who signs a re-ranking, and how a ranked item connects to a milestone and a resourced owner. Evaluators who know GAO-19-384 will read that as understanding of the requirement.
Timing adds pressure. CISA's BOD 26-04, a non-GAO directive for civilian agencies, sets remediation windows of 3, 14, or 60 days from December 7, 2026, as covered in our BOD 26-04 brief. Items on the Known Exploited Vulnerabilities (KEV) list can no longer wait for a quarterly re-sort.
The method below comes from Avalon's POA&M service. It works inside the agency's own system of record and describes how the work is done, at the methodology level.
Avalon does not accept risk, validate closure, or make authorization decisions. Technical fixes sit with the system owner or a remediation task.
GAO closed each recommendation on a written rule in a controlling document.
| Agency | Evidence GAO's notes record | Closed |
|---|---|---|
| HUD | Updated POA&M procedures requiring risk to inform prioritization | March 2020 |
| SBA | Updated risk management framework implementation procedures | March 2020 |
| NRC | Updated policies that prioritize POA&Ms on its organization-wide risk assessment | January 2021 |
| USDA | Updated policies and procedures using risk assessments for POA&M prioritization | October 2021 |
| NASA | Revised IT Security Handbook requiring risk in POA&M prioritization | January 2022 |
| State | Updated documentation with risk-based POA&M prioritization | Aug–Sep 2023 |
| Commerce | Updated Security and Privacy Assessment and Authorization Handbook | February 2024 |
| Labor | Updated policies tying POA&M prioritization to the risk management strategy | September 2025 |
On a contract, the targets are Avalon's own, not GAO's: every open item carries a risk rank traceable to the rule, an aging report cut by rank, and sampled closure packages that the assessor accepts on first review.
Closed, 8 of 8, as of GAO's last update on these recommendations, September 2025 (Labor). Across GAO-19-384, 55 of 58 are closed as implemented, and the three open ones (OMB rec 1, DOT recs 26 and 27) are not POA&M recommendations.
| NAICS | Avalon's sub role | Small-business status | Likely vehicles |
|---|---|---|---|
| 541512, 541519 | POA&M entry development, backlog rationalization, risk-ranked priority matrix, closure evidence packages, and SOP with cadence, inside the agency's system of record | Small business; HUBZone (in progress) | The agency's GSA MAS (SIN 54151HACS, SIN 54151S) and GSA OASIS+ task orders |
If a civilian agency's A&A or ISSO support recompete is in your capture plan, Avalon teams as the sub that ranks the ledger by the agency's own risk rule and leaves the government team a cadence it can run.