Short answer: A Plan of Action and Milestones (POA&M) is your written plan for closing the security gaps you’ve found. For defense contractors, it lists each NIST SP 800-171 requirement you haven’t fully met, what you’ll do about it, who owns it, and when it will be done. A POA&M is required by NIST SP 800-171 (requirement 3.12.2), but it is not a substitute for meeting the requirement. Under CMMC, an unimplemented requirement is scored NOT MET whether or not it’s on your POA&M, and only certain gaps may be carried on a POA&M at all.
What is a POA&M?
A POA&M is a living document that tracks security deficiencies from the moment you find them until they’re fixed. NIST SP 800-171 Rev. 2 requirement 3.12.2 asks organizations to “develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities.” NIST’s discussion of that requirement says plans of action describe how unimplemented requirements will be met and how planned mitigations will be implemented.
The POA&M works alongside your System Security Plan (SSP). The SSP describes how each requirement is implemented today. The POA&M describes how you’ll close the gaps the SSP reveals. NIST allows them to be separate or combined documents, in any format.
Who needs a POA&M?
- Contractors with DFARS 252.204-7012 in their contracts that handle Controlled Unclassified Information (CUI). They must implement NIST SP 800-171, which includes 3.12.2. See DFARS 252.204-7012 explained.
- Contractors reporting an SPRS score. Any requirement not yet implemented reduces your score. The POA&M shows how and when you’ll recover those points.
- Organizations pursuing CMMC Level 2. CMMC sets specific rules on when a POA&M is allowed (below).
What should each POA&M entry include?
Keep each entry specific enough that someone outside your team, such as an assessor or a prime contractor, can see exactly what’s missing and how it will be fixed.
| Field | What to record |
|---|---|
| ID | A unique number for tracking (e.g., POAM-014) |
| Requirement | The NIST SP 800-171 requirement number and title (e.g., 3.5.3 Multifactor authentication) |
| Weakness | What’s missing or partially implemented, in plain language |
| Source | How it was found: self-assessment, gap assessment, audit, incident, scan |
| Affected systems | Which systems, locations, or user groups are affected |
| Point value | The requirement’s weight in the DoD scoring methodology (1, 3, or 5) |
| Risk and interim measures | What could go wrong now, and any temporary safeguards in place |
| Planned actions | The specific steps to close the gap |
| Owner | One named person accountable for completion |
| Resources | Budget, tools, or outside help needed |
| Milestones | Intermediate steps with target dates |
| Target completion | Date the requirement will be fully met |
| Status | Open, in progress, completed (with date), or delayed (with reason) |
| Evidence of closure | What proves the fix: a configuration screenshot, policy, log, or ticket |
POA&M template
Copy this table into a spreadsheet or your compliance tool. One row per gap:
| ID | Requirement | Weakness | Points | Owner | Planned actions | Milestones | Target date | Status |
|---|---|---|---|---|---|---|---|---|
| POAM-001 | 3.5.3 Multifactor authentication | MFA not enforced for local admin accounts on 6 engineering workstations | 5 | IT lead | Deploy MFA for privileged local logons; update access procedure | Pilot on 2 machines; roll out to rest; update SSP | Open | |
| POAM-002 | 3.3.1 System auditing | Firewall logs retained 30 days; audit retention not defined | 5 | IT provider | Define retention in audit policy; forward logs to central storage | Policy approved; log forwarding configured; 30-day check | In progress | |
| POAM-003 | 3.2.2 Role-based training | No security training for privileged users | 5 | Security owner | Select training; assign to admins; track completion | Course selected; admins enrolled; completion verified | Open |
What are the CMMC rules for POA&Ms?
The CMMC program rule (32 CFR Part 170, § 170.21) limits when a POA&M can be used to reach a Conditional CMMC status:
- Level 1: no POA&M is allowed at any time. All 15 requirements must be met. See CMMC Level 1 vs. Level 2.
- Level 2 minimum score: your assessment score must be at least 80% of the total Level 2 requirements (at least 88 of 110 points).
- Only 1-point requirements: no requirement worth more than 1 point may be on the POA&M. The one exception is SC.L2-3.13.11 (CUI encryption) when encryption is used but isn’t FIPS-validated.
- Six requirements can never be on a POA&M:
- AC.L2-3.1.20 External connections
- AC.L2-3.1.22 Control public information
- CA.L2-3.12.4 System Security Plan
- PE.L2-3.10.3 Escort visitors
- PE.L2-3.10.4 Physical access logs
- PE.L2-3.10.5 Manage physical access
- 180-day closeout: POA&M items must be closed and confirmed by a POA&M closeout assessment within 180 days of the Conditional status date. For a self-assessment, you perform the closeout yourself. For a certification assessment, a C3PAO performs it. If you miss the deadline, the Conditional status expires.
The practical takeaway: a POA&M can bridge a few small gaps. It can’t carry an organization that hasn’t implemented most of NIST SP 800-171. Plan to close the high-value (3- and 5-point) requirements before any assessment. The full list of Level 2 requirements shows how they’re grouped.
How do you keep a POA&M credible?
- Tie every entry to evidence. An item isn’t closed until you can show the fix.
- Set realistic dates and report slips honestly. A POA&M with every date in the past and nothing closed signals a program that isn’t working.
- Review it on a regular schedule with the person who owns your security program, and update the SSP when items close.
- Keep the SPRS score in sync. When you close requirements, your score changes. An outdated or inflated score is a legal risk, not just a paperwork issue.
- Don’t hide gaps. A complete, honest POA&M is far safer than a short one that leaves known problems out.
Frequently Asked Questions
Does a POA&M item count as “met”?
No. Under the CMMC scoring methodology, a requirement that isn’t implemented is scored NOT MET, whether or not it’s described in a POA&M. The POA&M shows your plan; it doesn’t earn the points.
Can I put my System Security Plan on a POA&M?
No. CA.L2-3.12.4 (System Security Plan) is one of six requirements that can never be on a CMMC POA&M. Without a current SSP, an assessment can’t be completed. See what goes in an SSP.
How long can items stay on a POA&M?
For CMMC Conditional status, items must be closed and verified within 180 days of the Conditional status date, or the status expires. Outside CMMC, NIST SP 800-171 doesn’t set a fixed deadline, but primes and assessors expect realistic dates and steady progress.
Is there an official POA&M format?
NIST SP 800-171 allows any format, and the POA&M can be combined with the SSP. What matters is that each entry is specific, owned, dated, and backed by evidence when closed.
How USCIBER can help
USCIBER builds SSPs and POA&Ms that reflect how your environment actually works, scored against the DoD methodology so your SPRS score is accurate. The Compliance Documentation Project is scoped after a short call. If you don’t yet know your gaps, start with a CMMC Readiness Review from $7,500. USCIBER is a readiness consultant; it is not a C3PAO and does not issue CMMC certifications.
Sources
- 32 CFR Part 170 — § 170.21 Plan of Action and Milestones requirements and § 170.24 CMMC Scoring Methodology (eCFR)
- NIST SP 800-171 Rev. 2 — Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations, requirement 3.12.2
- DFARS 252.204-7012 — Safeguarding Covered Defense Information and Cyber Incident Reporting (eCFR)
- DoD CIO — Cybersecurity Maturity Model Certification
This article is general information, not legal advice.