CMMCpedia
Work with me

Terms / Assessment

Plan of Action and Milestones (POA&M)

A POA&M lists the CMMC requirements you have not met, who fixes each one, and by when. It buys a Conditional status and 180 days, not a pass.

Also called POA&M, POAM, Plan of Action and Milestones.

Official Source Material

Plan of Action and Milestones (POA&M) means a document that identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones, as defined in NIST SP 800-115 Sept2008 (incorporated by reference, see § 170.2).

Source: 32 CFR 170.4, eCFR text current as of September 17, 2026

Practitioner Guidance

What it means in practice

A POA&M buys you 180 days, not a certification.

A Plan of Action and Milestones (POA&M) lists every requirement your assessment scored as NOT MET. Each line names the work to close it, the resources it needs, the person who owns it, and the date it will be done. Under 32 CFR 170.21 an assessment with open POA&M items earns a Conditional CMMC Status. The clock then runs 180 days from the Conditional CMMC Status Date, the day your results reach SPRS, the Supplier Performance Risk System. Close every item inside that window and pass the closeout assessment, the reassessment that looks only at the requirements on the plan. Miss the window and the Conditional status expires.

Most requirements cannot go on a POA&M at all.

32 CFR 170.21 bars any requirement worth more than 1 point under the CMMC Scoring Methodology, the rule that gives each requirement its SPRS points. SC.L2-3.13.11 is the one exception. It may sit on a POA&M at 3 points when encryption is employed but is not FIPS-validated. FIPS 140 validation means the cryptographic module holds a certificate under the NIST Cryptographic Module Validation Program. The rule also bars six requirements by name whatever their value: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4, and PE.L2-3.10.5. Your score must still reach 88 out of 110 with the items open. Fix the high-value gaps before the assessment, because no plan can carry them. Your CUI, the information a law or regulation requires you to protect, sits in those systems while the items stay open. Close the gaps that leave it exposed first.

A POA&M is not the plan of action that CA.L2-3.12.2 asks for.

That requirement wants a standing plan of action for the deficiencies you find in your own monitoring, kept as part of running the system. A temporary deficiency recorded there is assessed as met. The POA&M in 32 CFR 170.21 is the assessment document that lists NOT MET requirements and starts the 180 day clock. Keep both. The CA.L2-3.12.2 plan never empties; the assessment POA&M must be empty at closeout.

What falls short

  • A POA&M that carries a 3 or 5 point requirement other than SC.L2-3.13.11. 32 CFR 170.21 does not allow it on the plan, so the assessment earns no Conditional status.
  • A line that says implement multifactor authentication with no owner, no milestone, and no date. The definition in 32 CFR 170.4 requires resources, milestones, and scheduled completion dates.
  • Closing an item by declaring it done. The closeout assessment re-examines the requirement against the same objectives, so you need the evidence, not the tick.

Edge cases

  • Level 1 has no POA&M. 32 CFR 170.21 permits none at any time for a Level 1 self-assessment. 32 CFR 170.15 requires a MET result for all 15 requirements, so fix first and affirm second.
  • You close every item on day 30. The Conditional status stands until the closeout assessment confirms the closure, so schedule the closeout as soon as the items are closed. It re-assesses only the requirements that were NOT MET.
  • The 180 days run out with an item open. 32 CFR 170.21 expires the Conditional CMMC Status for that information system. Closing the item afterward does not revive it; you need a new assessment.

Over-engineering

  • A governance platform bought to hold a handful of items. A spreadsheet with the requirement, the gap, the owner, the resources, the milestone, and the date meets the definition in 32 CFR 170.4, and your system security plan points to it.
  • POA&M entries for every requirement you rate as weak but MET. The POA&M lists the requirements assessed as NOT MET. Improvements to MET requirements belong in your CA.L2-3.12.2 plan of action.
  • One line item per objective letter. One line per NOT MET requirement, noting which objectives it missed, is enough.