Plan of Action and Milestones

What Is a POA&M?

A Plan of Action and Milestones, abbreviated POA&M and often written POAM, is a formal document that lists every security requirement an organization has not yet implemented, together with the corrective action planned for each one, the resources required, the person accountable, and the date the work will be finished. It is the companion document to the System Security Plan: the plan describes what is in place, and the POA&M describes what is not, along with how and when that will change.

The term comes from federal information security practice, where agencies have used POA&Ms for decades to track known weaknesses through to closure. Defense contractors encounter it through NIST SP 800-171 and the CMMC program, healthcare organizations through HIPAA risk management, and technology companies through SOC 2 and FedRAMP. The format varies. The purpose does not. A POA&M exists so that an unmet requirement is a scheduled piece of work rather than an unmanaged risk that everybody has quietly agreed to stop mentioning.

The distinction that matters most in practice is between a POA&M and a risk register. A risk register catalogs things that could go wrong. A POA&M catalogs specific control requirements that are currently failing, with a commitment attached to each. An assessor reading your POA&M is not evaluating your understanding of risk. They are checking whether you have an executable plan, whether the dates are credible, and whether the items on the list are ones you were permitted to defer in the first place.

That last point catches more organizations than any other. Teams arrive at assessment believing a POA&M is a general-purpose safety net, and discover that the majority of their gaps were never eligible for deferral. Craig Petronella, CMMC Registered Practitioner and author of the CMMC 2.0 Certification Guide, has watched that assumption end assessments before lunch. The rules are specific, they are published, and they reward organizations that read them before scheduling a C3PAO.

The POA&M and the System Security Plan

These two documents are read together, and inconsistency between them is one of the fastest ways to lose assessor confidence. The System Security Plan defines the system boundary, describes the environment, and explains how each of the 110 NIST SP 800-171 requirements is implemented. Where a requirement is not implemented, the plan should say so plainly and the POA&M should pick that thread up with a remediation commitment.

Problems appear when the two drift. A System Security Plan that claims multifactor authentication is fully deployed, sitting next to a POA&M with an open item for multifactor authentication on the administrative tier, tells the assessor that nobody is maintaining either document. So does a POA&M item referencing a system component that the plan never included in the boundary. Our practice is to treat them as one artifact with two views, generated from a single control set, which is how the ComplianceArmor® platform handles it: the implementation status field drives both outputs, so a control cannot be marked implemented in one document and deferred in the other.

There is also a hard regulatory reason to get the plan finished first. CA.L2-3.12.4, the requirement to develop and update a System Security Plan, is explicitly barred from appearing on a Level 2 POA&M. You cannot defer the document that describes your deferrals. If the plan is incomplete on assessment day, no POA&M can rescue the outcome. Organizations that have not started should begin with the System Security Plan and treat the POA&M as the output of that work rather than a parallel exercise.

What Belongs in a POA&M

There is no single mandated template across every framework, but assessors consistently look for the same fields. A POA&M missing any of these reads as aspirational rather than operational.

The evidence field is the one most often left blank, and it is the one that determines whether closeout goes smoothly. Deciding at the outset what artifact will demonstrate that a requirement is met, whether that is a configuration export, a signed policy, a training completion report, or a scan result, means the closeout assessment becomes a document review rather than a scramble.

What You Can and Cannot Defer

This is the section worth reading twice. The CMMC Program rule at 32 CFR 170.21 sets narrow conditions on POA&M use for Level 2 assessments, and organizations that plan around a looser reading of it lose both the assessment fee and the schedule.

The 80 percent floor

A POA&M is only permitted if your assessment score divided by the total number of CMMC Level 2 security requirements is greater than or equal to 0.8. With 110 requirements in play, that puts the minimum passing score at 88 points. Below that threshold there is no conditional status and no POA&M: the assessment result is a failure, and you start again. Running your score before booking an assessment is the single cheapest risk reduction available, and our SPRS score calculator exists for exactly that purpose.

The 1-point rule

Only requirements carrying a point value of 1 may appear on a Level 2 POA&M. The 3-point and 5-point requirements, which are the heavily weighted controls the scoring methodology treats as most consequential, must be fully implemented before the assessment. There is one carve-out: SC.L2-3.13.11, the requirement to use FIPS-validated cryptography to protect CUI, is permitted on a POA&M despite its higher weighting. That exception exists because FIPS-validated module procurement and deployment can legitimately run on a vendor timeline outside the organization's direct control.

The barred requirements

Six requirements cannot be placed on a Level 2 POA&M under any circumstances:

• AC.L2-3.1.20 - Verify and control connections to external systems
• AC.L2-3.1.22 - Control CUI posted or processed on publicly accessible systems
• CA.L2-3.12.4 - Develop, document, and periodically update System Security Plans
• PE.L2-3.10.3 - Escort visitors and monitor visitor activity
• PE.L2-3.10.4 - Maintain audit logs of physical access
• PE.L2-3.10.5 - Control and manage physical access devices

Notice the pattern. Four of the six are low-cost, low-technology requirements: escort your visitors, keep a visitor log, control your badges and keys, know what is connected to your network. They are barred precisely because there is no credible argument that an organization needs six additional months to start a visitor log. The other two, controlling CUI on public systems and maintaining a System Security Plan, are barred because deferring them would undermine the assessment itself.

The 180-day clock

Closing a POA&M must be confirmed by a POA&M closeout assessment within 180 days of the Conditional CMMC Status Date. If the POA&M is not successfully closed out in that window, the Conditional CMMC Status expires. The clock starts at the conditional status date, not at the point you finish remediation, and the closeout assessment itself takes scheduling. Treating day 180 as the deadline for finishing the work rather than the deadline for having the work verified is a common and expensive misreading. Work backward from the closeout date, not forward from the assessment.

How a POA&M Moves Your SPRS Score

The Supplier Performance Risk System score is the number your prime contractors and contracting officers can see, and it is derived directly from the same assessment that produces your POA&M. The methodology begins at 110 and subtracts the weighted value of each unimplemented requirement. A single 5-point requirement left open costs five times what a 1-point requirement costs, which is why the eligibility rules and the scoring math point in the same direction: fix the heavy controls, defer only the light ones.

Because POA&M items are by definition unimplemented, they are already reflected as deductions in the score you carry into conditional status. As each item closes and is verified, the corresponding points return. Organizations tracking this well can forecast their post-closeout score on day one, which turns the POA&M into a project plan with a visible finish line rather than a compliance obligation. Our SPRS score guidance walks through the arithmetic in more detail, and the free calculator lets you model the effect of closing specific items before you commit to a sequence.

One practical note: the order in which you close items should be driven by evidence availability and dependency, not by point value alone. A 1-point requirement that unblocks three others is worth doing first even though its individual contribution is small. Sequencing is where most of the recoverable time in a 180-day window actually lives.

The POA&M Lifecycle: Six Stages

POA&M Beyond CMMC

The document travels across frameworks, though the rules attached to it change considerably. Understanding which set of constraints applies to you prevents importing CMMC's strictness where it is not required, and importing CMMC's flexibility where it does not exist.

NIST SP 800-53 and FedRAMP. This is the POA&M's origin. FedRAMP requires a POA&M maintained on a defined cadence with remediation timelines keyed to finding severity, typically 30, 90, or 180 days by risk level. The format is prescribed and the review is continuous rather than event-driven.

HIPAA. The Security Rule does not use the term POA&M, but its risk management standard requires covered entities and business associates to implement measures sufficient to reduce risks to a reasonable level. In practice, a documented remediation plan coming out of the risk analysis is what Office for Civil Rights investigators ask to see, and it looks exactly like a POA&M. Craig Petronella, author of How HIPAA Can Crush Your Medical Practice, has seen the absence of that document turn a manageable finding into a systemic one.

SOC 2. There is no POA&M requirement, but a remediation tracker is how organizations manage the gap between a readiness assessment and the Type II observation window. Auditors do not assess the tracker itself; they assess whether controls operated effectively over the period, and a disciplined remediation plan is how you get there.

NIST SP 800-171 outside CMMC. Contractors carrying DFARS 252.204-7012 obligations without a CMMC assessment requirement still submit SPRS scores and still benefit from a POA&M, but the 180-day rule and the eligibility restrictions are CMMC constructs. Applying them voluntarily is good discipline. Assuming they are already binding on you can lead to spending money on a timeline nobody is enforcing.

Common POA&M Mistakes

Spreadsheet, Platform, or Managed

Most organizations start with a spreadsheet and outgrow it somewhere between the assessment and the closeout. Here is an honest comparison of the three common approaches.

There is no wrong answer for an organization with three open 1-point items and a compliance manager who owns the file. The calculus changes when the register has twenty items, four owners, a FIPS-validated cryptography dependency on a vendor roadmap, and a 180-day clock that started before the paperwork was finished.

How Petronella Technology Group Builds POA&Ms

Petronella Technology Group has operated from Raleigh since April 2002 and holds CyberAB Registered Provider Organization status, RPO #1449, with a CMMC-RP certified team. Our POA&M work runs in the same engagement as the System Security Plan, because separating them creates the divergence problem described above.

We begin with boundary and scope, since a POA&M written against the wrong system boundary is wrong in every row. From there we score all 110 requirements the way a C3PAO would, triage the NOT MET list against the eligibility rules before anything reaches the register, and flag the items you must fix pre-assessment as a separate, funded work plan. That triage step is where the value is: it is far cheaper to discover a barred requirement in a scoping conversation than in an assessment.

Documentation is produced through ComplianceArmor®, our compliance documentation platform, which generates the System Security Plan and the POA&M from one control set with evidence collection and continuous monitoring built in. For organizations handling CUI, we also design and operate CMMC enclaves that narrow the assessment boundary, which is frequently the fastest route to a higher score and a shorter POA&M. Engagements are scoped to clear deliverables with no long-term contract required, and we promise a defined scope rather than a specific assessment outcome, because no honest advisor controls a C3PAO's determination.

Continue Your CMMC Preparation

Plan of Action and Milestones Questions