What is a POA&M? The plan of action and milestones, explained
Published 2026-10-23, 12 min read
A POA&M (plan of action and milestones) is the list of security requirements you have not met yet, with the tasks, resources, milestones and dates that will close each one. Under CMMC it turns a Level 2 assessment that falls short into a Conditional status, inside four limits.
- 88of 110
- The Conditional minimum: below it, no POA&M earns a Conditional Level 2 status. § 170.21(a)(2)(i)
- 1point
- The most a Level 2 POA&M item may be worth. One exception: SC.L2-3.13.11 at 3, when you encrypt but not with FIPS-validated modules. § 170.21(a)(2)(ii)
- 6never
- Requirements that may never sit on a POA&M, whatever their point value. The SSP is one of them. § 170.21(a)(2)(iii)
- 180days
- To close every item, counted from the Conditional CMMC Status Date, or the Conditional status expires. § 170.21(b)
Level 1 has no POA&M: all 15 requirements must be met on the day you assess.
- In force today
- DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
- Suspended
- Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
- Not yet known
- The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
What a POA&M is, in the rule's words
The CMMC rule borrows its definition from NIST SP 800-115. Read it slowly: it names four things a POA&M has to hold, and nothing about a format.
Tasks
“tasks needing to be accomplished”
The steps that turn the gap into a met requirement: push the setting, test it, write it into the SSP.
Resources
“resources required”
Who does it and what it costs: your IT contractor's hours, a licence, a door reader.
Milestones
“any milestones in meeting the tasks”
Checkpoints you can prove: ordered, installed, tested, documented.
Dates
“scheduled completion dates for the milestones”
A date on every milestone, all of them inside the 180 days.
Under CMMC a POA&M is tied to an assessment. You score yourself (or an assessor scores you) against the 110 requirements of NIST SP 800-171 Rev 2; every requirement scored NOT MET needs a POA&M; and the rule calls it the plan for deficiencies that must be fixed within 180 days (the CMMC deadline guide counts that date and the others from your status date). The requirements themselves, and what each is worth, are in the CMMC Level 2 requirements.
POA&M, plan of action, operational plan of action
Three different documents answer to the name “plan of action”, and mixing them up is how shops end up with a POA&M full of things that could never sit on one. NIST SP 800-171 has the oldest: requirement 3.12.2, “Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.” CMMC adds the POA&M with its limits, and a third, lighter document for things that break after you fixed them.
| Question | CMMC POA&M32 CFR 170.21 | Plan of actionNIST SP 800-171 3.12.2 | Operational plan of action32 CFR 170.4 |
|---|---|---|---|
| What it covers | Requirements scored NOT MET in a CMMC assessment, within the limits of 170.21. | How any unimplemented requirement will be met and how planned mitigations will be put in place. | Temporary deficiencies that appear after a requirement was implemented: a patch, a reconfiguration, a module that lost its validation. |
| Deadline | Closed out within 180 days of the Conditional CMMC Status Date. | None in NIST. Under DFARS 7019 you post the date you expect to reach 110. | No remediation timeline; the rule sets no standard duration for a temporary deficiency. |
| How the item scores | NOT MET: its points still come off 110. | Not implemented, whether or not a plan of action is in place. | MET, if the plan includes deficiency reviews and shows progress. |
| Format | The definition lists contents (tasks, resources, milestones, dates); we found no prescribed form in Part 170. | Separate from the SSP or combined with it, in any chosen format. | Yours to define: a document, a spreadsheet or a database. |
| When you need it | When you want a Conditional status instead of a fail. | Always: requirement 3.12.2 asks for plans of action. | Whenever something you had working breaks and the fix is known. |
The operational plan of action is the useful one to know. If FIPS-validated encryption was in place and a patch moved the module off its validated version, that is a temporary deficiency: put it in an operational plan with deficiency reviews and visible progress, and the requirement is assessed as MET. It does not cover a first rollout that is still in progress (the one exception: a very limited subset of equipment that turns up its own problem during roll-out). An unfinished rollout is a gap, and it belongs on the POA&M. How NIST SP 800-171 and CMMC score the same gaps differently is in CMMC vs NIST SP 800-171.
What may sit on a POA&M
Sort the 110 Level 2 requirements by the two tests in 32 CFR 170.21 and most of them fall out: anything worth 3 or 5 points must be met on the day you assess, and 6 named requirements may never wait, even the 1-point ones.
- May wait on a POA&M
- 461-point requirements
- Must be met on the day
- 58worth 3 or 5 points
- Never on a POA&M
- 6named in 170.21(a)(2)(iii)
SC.L2-3.13.11 is counted with the 3- and 5-point group. If you encrypt CUI but the module is not FIPS-validated, it drops to 3 points and becomes the one item above 1 point that may wait.
Two more limits sit on top. Your score with every open item deducted must still be at least 88, the Conditional minimum, so the open items together can cost at most 22 points. And the list must be complete: every NOT MET requirement needs its row. One gap worth more than 1 point (say, multi-factor authentication on remote and admin accounts but not yet on everyone else, a 3-point deduction) means no Conditional status at all, however good the rest of the plan is.
POA&M: Allowed, under three conditions
- Score divided by 110 is 0.8 or more: at least 88, which leaves room for 22 points of open items. § 170.21(a)(2)(i)
- No item worth more than 1 point, except SC.L2-3.13.11 at 3 when encryption is employed but not FIPS-validated. § 170.21(a)(2)(ii)
- None of the 6 requirements below, whatever their value. § 170.21(a)(2)(iii)
Never on a POA&M
- AC.L2-3.1.20External Connections (CUI Data)
- AC.L2-3.1.22Control Public Information (CUI Data)
- CA.L2-3.12.4System Security Plan
- PE.L2-3.10.3Escort Visitors (CUI Data)
- PE.L2-3.10.4Physical Access Logs (CUI Data)
- PE.L2-3.10.5Manage Physical Access (CUI Data)
The 180-day closeout
A Conditional status is a loan against your POA&M, and it falls due 180 days after the Conditional CMMC Status Date. Closing it is not an email: it is a POA&M closeout assessment, a CMMC assessment that looks only at the NOT MET requirements you listed.
Day 0
Conditional status
Results go into SPRS (or the CMMC instance of eMASS). That date becomes your CMMC Status Date, and your Affirming Official affirms.
§ 170.4; § 170.22(a)(3)(i)
In between
Work the rows
Each milestone closes on its date. DFARS 252.204-7021 treats a Conditional status as current only while it is not older than 180 days.
DFARS 252.204-7021(a)
By day 180
Closeout assessment
Only the NOT MET requirements on the POA&M are assessed again, then the results are posted and affirmed.
§ 170.21(b); § 170.22(a)(3)(iv)
After
Final status
The status date does not move: your three-year cycle still counts from day 0. Affirm every year after.
§ 170.4; § 170.22(a)(3)(iii)
| Status | Closeout assessment by |
|---|---|
| Level 2 (Self) | You, in the same manner as the initial self-assessment § 170.21(b)(1) |
| Level 2 (C3PAO) | An authorized or accredited C3PAO § 170.21(b)(2) |
| Level 3 (DIBCAC) | DCMA DIBCAC § 170.21(b)(3) |
Where the closeout fits in the whole path, from scoping to the first affirmation, is in how to get CMMC certified.
What a good POA&M row holds
The rule gives you the contents; the assessor gives you the test. At the closeout assessment someone will read each row and then look for the evidence. Write the row so that reading it tells them exactly what to look at.
| Field | What to write | Where it comes from |
|---|---|---|
| Requirement | The CMMC id and its NIST number, one requirement per row. | 170.21 names requirements by CMMC id |
| Point value | 1, or 3 for SC.L2-3.13.11 when encryption is not FIPS-validated. Anything else cannot be on the row. | 170.21(a)(2)(ii); 170.24 |
| Weakness | Which assessment objectives are not met, on which assets. "MFA incomplete" is not a weakness; "two shop-floor workstations" is. | 800-171A 3.12.2[a] |
| Tasks | The steps that make the requirement MET. | 170.4: tasks needing to be accomplished |
| Resources | People, hours, money and anything you must buy. | 170.4: resources required |
| Milestones and dates | Checkpoints with a date each, every date inside the closeout window. | 170.4; 170.21(b) |
| Owner | One named person, not "IT". | Our practice |
| Evidence at close | What the closeout assessment will see: a setting, a log, a signed procedure, in final form. | 170.24(b)(1) |
IA.L2-3.5.3
“Roll out MFA. Owner: IT. Due: when the budget allows.”
- MFA is worth 5 points, or 3 if it already covers remote and privileged users. Either way it is over 1 point, so it cannot be on a POA&M at all.
- No weakness, no tasks, no resources, no milestones.
- No date: the closeout window does not wait for a budget.
AC.L2-3.1.101 pointExample only
- Weakness
- The two CAM workstations on the shop floor, which open customer drawings marked CUI, never lock when left idle.
- Tasks
- Push a 15-minute lock with a blank screen by group policy; test on both machines; update the SSP entry.
- Resources
- IT contractor, about 3 hours. No purchase.
- Milestones
- Day 14: policy pushed
- Day 21: tested on both workstations
- Day 30: SSP updated, screenshots filed
- Owner and due
- Operations manager, Day 30 of 180
The POA&M template builder asks for exactly these fields and checks every row against 32 CFR 170.21 as you type: it marks a 3- or 5-point requirement not allowed, flags a date after the closeout, and keeps the running score against the Conditional minimum. Start from your SPRS score, not from a blank sheet.
Where the plan shows up in SPRS
Which plan the government sees depends on the clause in your contract. Under the older SPRS clause, your plan of action produces one date. Under CMMC, the POA&M itself is part of the status you post.
A contract with DFARS 252.204-7019
What goes into SPRS
- Your summary score, e.g. 95 out of 110
- The date all requirements are expected to be implemented, that is, a score of 110, based on your plans of action
- No minimum score and no closing deadline in the clause: the date is yours to state, and to keep
A contract with CMMC Level 2 (Self)
What goes into SPRS
- Your overall score, e.g. 105 out of 110, with the CMMC Status Date, scope and CAGE codes
- POA&M usage and compliance status, if you have one
- The 170.21 limits apply: a score of at least 88, 1-point items only, closed out within 180 days
Under Class Deviation 2026-O0025 Rev 3, 252.240-7997 (FEB 2026) replaces 7020, and the self-assessment route is CMMC Level 1 or 2 (Self) under 7021. Contracts already awarded keep the clause versions they carry. Read your contract before you decide which plan you are writing. The two SPRS clauses are walked through in DFARS 7019 and 7020.
POA&Ms today
Part 170 has not been amended since it took effect on 2024-12-16, so every POA&M rule on this page is rule text in force. What contracts can ask of you right now is in the status block near the top of this page, and in more detail in CMMC status today.
For this one document the reading is short. Wherever a contract asks for CMMC Level 2 (Self), 32 CFR 170.21 decides which gaps may wait and for how long. Wherever it carries DFARS 252.204-7012 without a CMMC level, NIST SP 800-171 Rev 2 still applies in full, requirement 3.12.2 included, and your plan of action is what stands behind the date you post.
Questions about POA&Ms
Can a Level 1 contractor use a POA&M?
No. A POA&M is not permitted at any time for Level 1 self-assessments: all 15 requirements must be met when you assess and affirm. The list is in the CMMC Level 1 requirements.
Do items on my POA&M count toward my score?
No. A requirement that is not implemented is scored NOT MET whether or not it is on a POA&M, and its points still come off 110. The POA&M decides whether you get a Conditional status, not what you score.
Can the system security plan go on a POA&M?
No. CA.L2-3.12.4 is one of the 6 named requirements that may never be on one, and without an up-to-date SSP at the time of assessment the assessment cannot be completed. Start with the SSP template.
Does closing out the POA&M restart my three-year clock?
No. The date of the Conditional status stays your CMMC Status Date after a successful closeout; no new date is set for the Final status that follows it.
What happens if I miss the deadline?
The Conditional status expires 180 days after its status date if the POA&M is not closed out. Inside a contract's period of performance, standard contractual remedies apply, and you are not eligible for new awards needing that level for that system until you achieve a new CMMC status.
Is an operational plan of action the same thing?
No. An operational plan of action covers temporary deficiencies that arise after a requirement was implemented, has no remediation timeline, and the requirement is scored MET if the plan shows reviews and progress. A POA&M covers requirements scored NOT MET and must be closed within 180 days.
Does my POA&M have to be in a special format?
The CMMC definition lists what it must hold (tasks, resources, milestones and scheduled completion dates), not a form, and NIST lets you keep a plan of action separate from the SSP or combined with it, in any chosen format. A spreadsheet works if every row is complete. Software that keeps one for you is compared in CMMC compliance software.