Fettle logoFETTLEPeople · Process · Proof
Sign inStart Free Trial

What Is a POA&M? Plans of Action Under CMMC

Last reviewed by Fettle Editorial Team

What a POA&M is

A Plan of Action and Milestones (POA&M) lists the security requirements you do not yet meet, and for each one, what you will do to fix it, who is responsible, and by when. NIST SP 800-171 requirement 3.12.2 calls for plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities.

A POA&M is a plan, not a pass. Under the CMMC scoring rules, an item on a POA&M still counts as not met.

What CMMC allows

Level 1: none

POA&Ms are not permitted at Level 1. Every one of the 15 requirements must be met at the time of the self-assessment.

Level 2: conditional status, with limits

You can reach Conditional Level 2 status with open POA&M items only if all of these are true:

  • Your assessment score is at least 80% of the maximum (88 out of 110).
  • Every item on the POA&M is a requirement worth 1 point. The one exception is encryption that is in use but not FIPS-validated (SC.L2-3.13.11).
  • None of the items is on the excluded list. These must be met at assessment time:
    • AC.L2-3.1.20 (external connections)
    • AC.L2-3.1.22 (control of publicly posted information)
    • CA.L2-3.12.4 (System Security Plan)
    • PE.L2-3.10.3 (escort and monitor visitors)
    • PE.L2-3.10.4 (physical access logs)
    • PE.L2-3.10.5 (manage physical access devices)

The 180-day clock

Open items must be closed and verified in a POA&M closeout assessment within 180 days of your conditional status date. For a self-assessment, you do the closeout yourself; for a certification, the C3PAO does.

If the deadline passes without a successful closeout, conditional status expires. Your Affirming Official also has to affirm again after the closeout.

What a good POA&M contains

For each open item:

  • The requirement (and the specific assessment objectives not met).
  • What is wrong, in plain terms.
  • The planned fix, specific enough that someone else could check it is done.
  • An owner: a named person, not a department.
  • Milestones with dates, ending well inside the 180-day window.
  • Resources: budget, tools, or outside help needed.
  • Status, updated as work progresses.

Cross-reference each item from the matching section of your System Security Plan, so the two documents tell the same story.

Managing it well

  • Review it on a schedule (weekly or monthly), not just before assessments.
  • Collect the evidence as you close items. The closeout assessment needs proof that each fix is in place.
  • Do not let it become permanent. Outside CMMC's 180-day rule, a POA&M that never shrinks is a sign the plan is not real.

Sources