POA&M for CMMC: What a Plan of Action and Milestones Can and Can't Cover

What is a POA&M?

A POA&M, or plan of action and milestones, is a document that lists security gaps and the plan to close each one. NIST’s glossary, quoting SP 800-53 Rev 5, defines it as “a document that identifies tasks that need to be accomplished. It details resources required to accomplish the elements of the plan, milestones for meeting the tasks, and the scheduled completion dates for the milestones.”

For a defense contractor, the requirement comes from NIST SP 800-171 Rev 2, requirement 3.12.2: “Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.” The discussion under it says plans of action “describe how any unimplemented security requirements will be met and how any planned mitigations will be implemented.” You can keep it separate from your system security plan or combine them, “in any chosen format.”

The SSP describes what you have. The POA&M describes what you don’t have yet and when you will. We cover the SSP side in our system security plan template guide.

Can I use a POA&M at CMMC Level 1?

No. 32 CFR 170.21(a)(1) is one sentence: “A POA&M is not permitted at any time for Level 1 self-assessments.” The scoring section, 170.24(c)(1), says the same thing and adds that Level 1 results are scored MET or NOT MET “in their entirety.”

So at Level 1, all 15 safeguards have to be done before your Affirming Official signs in SPRS. There’s no conditional status to fall back on. Our CMMC Level 1 guide walks through the 15.

How does CMMC limit a POA&M at Level 2?

At Level 2, a POA&M gets you a Conditional status only if it meets every condition in 170.21(a)(2). There are three, and they apply the same way whether you self-assess or a C3PAO assesses you.

1. A minimum score. Your score divided by the number of Level 2 requirements has to be at least 0.8. With 110 requirements, that’s 88 of 110. Your score starts at 110, and 170.24 subtracts 1, 3, or 5 points for each requirement NOT MET. It can go negative. If you’re not sure where you stand, start with our SPRS score guide.

2. One-point requirements only. Nothing on the POA&M can be worth more than 1 point. The one exception is SC.L2-3.13.11, CUI encryption. If you encrypt but the module isn’t FIPS-validated, that’s a 3-point deduction, and the rule lets it go on the POA&M anyway.

That rules out every 5-point requirement, which includes account control, security training, audit logging, baseline configurations, incident response, boundary protection, and malware protection. It also rules out partial MFA. MFA for remote and privileged users only is a 3-point deduction, so it can’t go on a POA&M.

3. Six requirements that can never be on it:

• AC.L2-3.1.20 External Connections
• AC.L2-3.1.22 Control Public Information
• CA.L2-3.12.4 System Security Plan
• PE.L2-3.10.3 Escort Visitors
• PE.L2-3.10.4 Physical Access Logs
• PE.L2-3.10.5 Manage Physical Access

The SSP is on that list for a reason. Under 170.24, if you don’t have an up-to-date SSP at assessment time, the assessment “could not be completed.”

One more line in 170.24 matters here. “A POA&M addressing NOT MET security requirements is not a substitute for a completed requirement.” Anything on the POA&M still scores NOT MET. The POA&M doesn’t raise your score. It only buys you time.

What happens in the 180 days?

You have 180 days from your Conditional CMMC Status Date to fix every item and pass a POA&M closeout assessment. Per 170.21(b), the closeout only looks at the requirements that were on the POA&M. If you don’t close it out in time, “the Conditional CMMC Status for the information system will expire.”

Who does the closeout depends on how you were assessed:

• Level 2 (Self): you do it yourself, the same way as the original self-assessment, and post the results in SPRS.
• Level 2 (C3PAO): an authorized C3PAO has to do it.

What's the difference between Conditional and Final status?

Conditional means your assessment left a POA&M open and that POA&M meets the 170.21 rules. Final means you scored a passing result with nothing open. 32 CFR 170.16 says you can reach Final on the first self-assessment or through a POA&M closeout.

The rule also spells out what happens if a Conditional Level 2 (Self) status expires during a contract: “standard contractual remedies will apply,” and you can’t get new awards that require Level 2 (Self) or higher for that system until you get a new status. On the contracting side, the DoD’s current class deviation for DFARS Part 240 says Level 2 and 3 “can be in a conditional level for a period not to exceed 180 days” and “award can occur with a conditional CMMC level.” Level 1 “requires a final CMMC level for award.”

Does the Phase 2 suspension change any of this?

No. The July 13, 2026 memo suspended the Phase 2 move to C3PAO assessments, so new contracts ask for Level 1 (Self) or Level 2 (Self). On September 3, 2026, the DoD signed Class Deviation 2026-O0025, Revision 3, which writes that memo into contracting guidance and keeps “baseline compliance with NIST SP 800-171 Rev 2” under DFARS 252.204-7012. The POA&M rules in 170.21 apply to Level 2 (Self), so they’re as live as ever. Our Level 2 requirements guide has the full timeline.

What goes in a usable POA&M row?

One row per NOT MET requirement, with enough detail that someone else could pick it up and finish it. Start from NIST’s definition (tasks, resources, milestones, dates) and add what CMMC scoring needs. We’d want these columns:

1. Requirement ID in CMMC format, like IA.L2-3.5.6.
2. Point value from the 170.24 table. If it’s more than 1, it doesn’t belong on a CMMC POA&M (except non-FIPS encryption).
3. The gap, in plain words. “Accounts aren’t disabled after a set period of inactivity,” not “partially implemented.”
4. Affected systems. Which assets in your scope are short.
5. Planned fix. The specific change, and any interim mitigation.
6. Owner. A named person, not “IT.”
7. Resources. Licenses, hardware, outside help, hours.
8. Milestones with dates, each one checkable.
9. Scheduled completion date that falls well inside the 180 days.
10. Status and evidence. Open or closed, and where the proof lives. 170.24 says evidence has to be “in final form and not draft.”

A spreadsheet works fine. NIST doesn’t require a format, and neither does the CMMC rule. What matters is that every row ties to a requirement, an owner, and a date you can hit.

One more distinction from 170.24: something that breaks after you’ve implemented it is different. “Temporary deficiencies” covered by an operational plan of action that shows progress are assessed as MET. That’s ordinary upkeep. The assessment POA&M under 170.21 is for things you never finished.

Key takeaways

What this looks like when we do it

We’re not a C3PAO or a Registered Practitioner Organization, and we don’t perform CMMC assessments. Our job is the IT work that closes POA&M rows, and keeping the evidence that proves it.

For a manufacturer, that usually means doing the 5-point items first, since they can’t go on a POA&M at all. MFA for every user, named accounts, logging, patching, and endpoint protection go in before anyone scores anything. The smaller items that are left get a row, an owner, and a date, and we work them down from the same RMM and Microsoft 365 tooling that produces the evidence. On the plant floor, we isolate legacy controllers instead of forcing replacements. Our manufacturing IT page covers how we handle OT.

Sitting near 88 and not sure which gaps fit on a POA&M? Book a call and we’ll go through the list with you, or see how we run CMMC compliance for defense contractors first.