A plan of action and milestones for CMMC Level 2, one row per requirement you scored NOT MET. Each row is checked as you type against what 32 CFR 170.21 lets wait, and the plan downloads as a CSV, copies into a spreadsheet or prints for the file.
POA&M builder
The POA&M rules below are what Part 170 says. Whether a contract asks you for a CMMC status at all is a separate question, and the program is mid-reform:
Status as of 2026-10-23
In force today
DFARS 252.204-7012 still applies: NIST SP 800-171 Rev 2 on systems that hold covered defense information, cyber incidents reported to DoD within 72 hours, and FedRAMP Moderate or equivalent for any cloud that holds it. DFARS 252.204-7012(b)(2), (c)
Suspended
Phase 2, due in November 2026, is suspended for every contractor, whatever its size: contracts are not adding the third-party Level 2 (C3PAO) or Level 3 (DIBCAC) requirements. DoW CIO memo of 2026-07-13, applied by Class Deviation 2026-O0025 Rev 3
Not yet known
The outcome of the CMMC Reform Task Force review is not confirmed as of 2026-10-23: no report or rule change has been published. Federal Register search, 2026-10-23
A plan of action and milestones (POA&M) lists each security requirement you have not met, what is wrong, who fixes it and by when. Under CMMC it does one more thing: it lets a contractor that scored at least 88 of 110 hold a Conditional Level 2 status while a short list of small gaps is closed. The full background is in what is a POA&M; this page is the working document.
Two plans share the name, and mixing them up makes a self-assessment overstate itself. NIST SP 800-171 requirement 3.12.2 asks you to keep plans of action running all the time. The rule treats a gap handled that way differently from a gap left on the assessment POA&M:
Rule text
Temporary deficiencies that are appropriately addressed in operational plans of action (i.e., include deficiency reviews and show progress towards the implementation of corrections to reduce or eliminate identified vulnerabilities) shall be assessed as MET.
A POA&M addressing NOT MET security requirements is not a substitute for a completed requirement.
32 CFR 170.24(b)(1)(ii) and (c)(2)(i)(B)(6), eCFR, read 2026-10-22
So a plan does not earn points. Every row in this builder still counts against the score until it is done; the score the tool shows is 110 minus the rows you have not finished.
02Fill in the company, the systems in scope and the Conditional CMMC Status Date (the day the results go into SPRS). The closeout date appears at once.
03Add one row per NOT MET requirement. Pick it from the list, write the weakness as an assessor would read it, name the resources the fix needs, and give each milestone a date.
04Read each row's check. A red Not allowed means that requirement has to be MET before the assessment, not planned for after it.
05Download the CSV for your records, or print it and put it with the SSP. Mark rows Done as each fix is implemented and checked.
Which of the 110 can wait
The rule sorts every Level 2 requirement by what it is worth when missing: 5, 3 or 1 point. Only the 1-point ones may sit on the POA&M, and six requirements are named as never, whatever they are worth.
May wait
46
1-point requirements the rule lets sit on a POA&M
May wait, if
1
SC.L2-3.13.11, when CUI is encrypted but the module is not FIPS-validated
Must be MET
58
worth 3 or 5 points (the encryption case above aside)
Must be MET
6
named in 170.21(a)(2)(iii), whatever their points
Two requirements earn partial credit: MFA (IA.L2-3.5.3) costs 3 points if used only for remote and privileged users, 5 if not used at all; encryption (SC.L2-3.13.11) costs 3 points if not FIPS-validated, 5 if absent. Only the encryption one at 3 points may wait. Try any requirement here:
Can this gap wait?
Employ FIPS-validated cryptography when used to protect the confidentiality of CUI.
May waitSC.L2-3.13.11, 3 points
3 points, allowed only because encryption is employed but not FIPS-validated (170.21(a)(2)(ii)).
Worked example: a 22-person machine shop
The shop machines parts to a prime's drawings and scored itself on 2026-10-15. It put 7 findings on the plan and fixed one within a week. With the other 6 still open the score is 102 of 110, well clear of the 88 a Conditional status needs, yet the shop cannot claim one: PE.L2-3.10.4, the visitor log, is worth one point but is one of the six the rule names as never.
The example, row by row
The example POA&M rows with their points and rule check
Requirement
Weakness
Points
Check
AC.L2-3.1.10
Six CAM and CMM workstations on the shop floor stay signed in all shift; no screen lock is set.
1
Allowed
IA.L2-3.5.8
Domain policy kept no password history; staff switched between two passwords.
1
Done (MET)
SC.L2-3.13.11
The drawings share on the NAS is encrypted, but with a module that has no FIPS validation certificate.
3
Allowed
AU.L2-3.3.4
When the log server's disk fills, it stops recording and nobody is told.
1
Allowed
MP.L2-3.8.9
The weekly backup drive goes home with the owner and is not encrypted.
1
Allowed
AT.L2-3.2.3
Yearly training covers phishing but not the signs of an insider threat or how to report one.
1
Allowed
PE.L2-3.10.4
The visitor sign-in sheet at the front door misses vendors who come in through the loading dock.
1
Not allowed
The fix is cheap: send dock deliveries through the front-door log and the row is done. The score moves to 103, no row is refused, and the Conditional Level 2 (Self) status is open. That is the pattern to look for in your own list: a 1-point gap you might happily schedule for next quarter can still block the status if the rule names it.
The dates carry the second test. The closeout is due 180 days after the status date, on 2027-04-13. The last open step is due 2027-03-31, leaving 13 days for the closeout self-assessment itself.
180 days, drawn to scale
Day 0, 2026-10-15: Conditional status
Day 22: PE.L2-3.10.4 due
Day 29: AC.L2-3.1.10 due
Day 50: AU.L2-3.3.4 due
Day 106: MP.L2-3.8.9 due
Day 134: SC.L2-3.13.11 due
Day 167: AT.L2-3.2.3 due
Day 180, 2027-04-13: closeout or the status expires
Each purple tick is a row's scheduled completion; the red line is the closeout deadline in 32 CFR 170.21(b).
After the plan: closeout, affirmation and the SPRS date
The rule defines a POA&M as a document that identifies the tasks to be done, the resources they need, the milestones and the scheduled completion dates. That is why the template asks for resources on every row: a plan without them does not match the definition in 32 CFR 170.4.
170.21(b)A POA&M must be closed out within 180 days of the Conditional CMMC Status Date, or the Conditional status expires. The closeout assesses only the requirements that were on the POA&M. For a Level 2 (Self) status you run it yourself, the same way as the first self-assessment; for Level 2 (C3PAO) an authorized C3PAO runs it.
170.4The CMMC Status Date is the day the results go into SPRS (or eMASS for a C3PAO). After a successful closeout the Conditional date stays the status date: the Final status gets no new one, so plan the next assessment from that first date.
170.22An Affirming Official, a senior representative of the company, affirms in SPRS after every assessment, after a POA&M closeout, and annually after a Final status. Under DFARS 252.204-7021 a Conditional status counts as current for 180 days at most.
If your contract carries the codified DFARS 252.204-7019, its SPRS entry has a field this plan fills in for you. Contracts already awarded keep the clause versions they carry; see DFARS 7019 and 7020 for which text yours has.
Rule text
(F) Date that all requirements are expected to be implemented (i.e., a score of 110 is expected to be achieved) based on information gathered from associated plan(s) of action developed in accordance with NIST SP 800-171.
Use the last scheduled completion on this plan for that date, and update it when the plan moves. How to submit your SPRS score walks through the form; the SSP template is where the plan is referenced, since an assessment cannot be completed without an up-to-date SSP.
Questions about POA&Ms
Questions
Can I use this template for a Level 1 gap?OpenClose
No. Level 1 is MET or NOT MET in its entirety; no POA&M is permitted for Level 1. All 15 requirements have to be in place before you affirm. The Level 1 checklist is the right tool there.
Does the 180-day closeout still apply while Phase 2 is suspended?OpenClose
Part 170 has not been amended since it took effect on 2024-12-16 (eCFR, current to 2026-10-20), so 170.21 reads the same today. What changed is which assessments contracts ask for: Level 2 (Self) can still be required, the third-party requirement is suspended. The status box on this page holds the current read; the CMMC status page has the detail.
What happens on day 181 if a row is still open?OpenClose
The rule is blunt: if the POA&M is not successfully closed out within the 180-day timeframe, the Conditional CMMC Status for the information system will expire. Schedule the last milestone with room for the closeout self-assessment itself.
Can the SSP go on the POA&M while we finish writing it?OpenClose
No. CA.L2-3.12.4 is one of the six requirements the rule never lets wait, and without an up-to-date SSP at the time of assessment the assessment cannot be completed at all.
Is this the same as the FedRAMP POA&M template?OpenClose
No. FedRAMP's template, now listed on its Legacy Documentation page, “provides a structured framework for aggregating system vulnerabilities and deficiencies through security assessment and continuous monitoring efforts” for cloud services. This builder follows 32 CFR 170.21 for a contractor's own CMMC Level 2 assessment. If you are choosing cloud tools, the CMMC vs FedRAMP page sorts out which rule applies.
Where does what I type go?OpenClose
Nowhere. The plan is kept in your browser's local storage on this computer; the CSV, the copy and the printout are made in the browser. Clear your browser data and it is gone, so download the CSV.