What is a Plan of Action and Milestones (POA&M)?
A Plan of Action and Milestones (POA&M) is the CMMC and NIST document that lists each unmet security requirement with the planned fix, the owner and the dates. At a CMMC assessment only a limited set of requirements may sit on a POA&M, and they must be closed within 180 days.
What it contains
NIST SP 800-171 requirement 3.12.2 asks organisations to develop and implement plans of action to correct deficiencies and reduce or remove vulnerabilities. The POA&M is where those plans are written down. It sits alongside the System Security Plan: the SSP says how each requirement is met, and the POA&M lists the ones that are not met yet.
- Requirement. The requirement or weakness, by its identifier.
- Plan. What will be done to meet it, and any interim measure in place.
- Owner and resources. Who is responsible and what it needs.
- Milestones. Dated steps towards completion, and the current status.
The CMMC rules
For a CMMC Level 2 assessment, a POA&M is allowed only if the assessment score is at least 80 per cent of the maximum, which is 88 of the 110 points. Only requirements worth one point can be placed on it, with a narrow exception for encryption that is in use but not FIPS-validated. Some one-point requirements can never be deferred, including having a System Security Plan.
If the conditions are met, the contractor receives conditional status. Every POA&M item must then be closed within 180 days and confirmed by a POA&M close-out assessment. If that does not happen, the conditional status expires. Level 1 does not allow a POA&M at all.
Using it well
Assessors read the POA&M to judge whether the gaps are understood and under control. An item with a vague plan, no owner or a date that has already passed tells them the opposite. Keep each item specific and keep the dates real.
Outside CMMC, the POA&M is a standing document in FedRAMP, where cloud providers update it monthly as part of continuous monitoring. In each case it works best as a live register of open items, reviewed regularly, rather than a document written for the assessment and then left alone.
Questions
Plan of Action and Milestones (POA&M), answered
Can we pass CMMC Level 2 with open POA&M items?
You can receive conditional status if you score at least 88 of 110 and every open item is eligible. Final status follows once all items are closed and verified within 180 days.
What is the difference between a POA&M and an SSP?
The System Security Plan describes the system and how each requirement is met. The POA&M lists the requirements that are not yet met and the plan to meet them. An assessor reads both.
Is a POA&M the same as a corrective action plan?
They serve a similar purpose. A POA&M is the specific format used in NIST-based programmes such as CMMC and FedRAMP; a corrective action plan, or CAPA, is the more general term used after audit findings and incidents.
Working through this for an audit?
Talk it through with someone who has run the audit before, or look up another term.
- Each customer workspace has its own database
- Every change written to a tamper-evident activity log
- Auditors get scoped, read-only access
- AI suggestions wait for a person to accept them