POA&M: What Belongs on It and What Doesn’t

The plan of action and milestones is the most misunderstood document in CMMC, and the misunderstanding runs in a specific direction. People treat the POA&M as a place to put things they have not done, as if writing something down converts it from a failure into a plan.

It does not. The rule is unusually blunt about this. From 32 CFR 170.24:

“Security requirements not implemented, whether described in a POA&M or not, is assessed as ‘NOT MET.'”

A POA&M does not shelter a requirement from scoring. It costs you the full point value either way. What it buys is 180 days — and only if your score still clears the bar after the deduction.

Once you internalize that, most POA&M questions answer themselves. Here is what belongs on it, what does not, and the two mistakes I see most often — one of which actively costs companies points they did not need to lose.

The eligibility rules, exactly

Level 1: no POA&Ms at all

32 CFR 170.21(a)(1): “A POA&M is not permitted at any time for Level 1 self-assessments.” All fifteen requirements, implemented, or you do not have Level 1. There is no partial credit and no deferral.

Level 2: a point-value gate, plus six named exclusions

This is where the common framing goes wrong. People describe it as “there’s a published list of controls you can’t POA&M.” That is not how the rule works. It is a point-value rule with a short list of named exceptions layered on top.

Three conditions, all of which must be met, for Conditional Level 2 status:

1. The score threshold. “The assessment score divided by the total number of CMMC Level 2 security requirements is greater than or equal to 0.8.” The rule expresses it as a ratio. With 110 requirements that is 88 — but quote the ratio, because the number is derived.
2. The point gate. “None of the security requirements included in the POA&M have a point value of greater than 1” — with exactly one exception: SC.L2-3.13.11 (CUI Encryption) may go on a POA&M at its 3-point value if encryption is employed but is not FIPS-validated.
3. The named exclusions. None of six specific requirements may appear on the POA&M, regardless of point value.

The six:

Identifier	Name
AC.L2-3.1.20	External Connections (CUI Data)
AC.L2-3.1.22	Control Public Information (CUI Data)
CA.L2-3.12.4	System Security Plan
PE.L2-3.10.3	Escort Visitors (CUI Data)
PE.L2-3.10.4	Physical Access Logs (CUI Data)
PE.L2-3.10.5	Manage Physical Access (CUI Data)

Why name these separately? Five of them are 1-point requirements that would otherwise sail through the point gate. And CA.L2-3.12.4 — the system security plan — carries no point value at all under the DoD Assessment Methodology, so the gate could never have caught it.

You cannot POA&M your SSP. The methodology is explicit that its absence “would result in a finding that an assessment could not be completed due to incomplete information.” No SSP means no assessment at all. If you take one thing from this post, take that one.

The arithmetic consequence of all this is worth spelling out. At 110 requirements, the gap between the 88 threshold and a perfect score is 22 points. Since only 1-point items are eligible, your entire POA&M budget is at most about 22 line items — and if you use the encryption carve-out, that one item consumes 3 of your 22 by itself.

That is a much smaller allowance than most people picture when they hear the word POA&M.

What actually goes on it

NIST SP 800-171 Rev. 2, requirement 3.12.2, is short: “Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.”

Note the words designed to correct. A POA&M is a remediation commitment, not a disclosure.

The CMMC guidance on that practice puts content around it. Each entry should carry:

• Ownership — a named person accountable for the plan’s performance, not a department.
• Specific steps that are clear and actionable. “Improve logging” is not a step. “Enable Windows Security event forwarding to the SIEM for the twelve servers in the CUI enclave” is.
• Assigned responsibility for each step, not just for the entry as a whole.
• Milestones that let someone measure progress before the deadline arrives.
• Completion dates you can actually meet.

One drafting note. 32 CFR 170.21 itself specifies no required fields — it governs eligibility and timing only. So the content standard comes from 800-171 and the CMMC practice guidance, not from the CMMC rule. That is a genuine gap, and it means there is no official template to hide behind. Write it so a stranger can audit it.

Three things that do not belong on it

1. Anything you do not actually intend to fix

This is not a philosophical point. It is the fact pattern in a settled False Claims Act case.

In October 2024, Pennsylvania State University paid $1.25 million to resolve FCA allegations covering fifteen DoD and NASA contracts. Among the specific allegations: that it “failed to implement cybersecurity controls… and did not adequately develop and implement plans of action to correct deficiencies it identified,” and that it “knowingly misstated the dates it expected to implement required security controls.”

Read that last clause again. Putting an aspirational date on a POA&M item is conduct the Justice Department has already prosecuted. Not the failure to implement — the date.

The structure of the rule reinforces it. The POA&M requires a closeout assessment within 180 days. Your affirming official attests that the organization “has implemented and will maintain implementation of all applicable CMMC security requirements.” There is no version of this where a placeholder date is harmless.

If you do not have a funded, scheduled path to closing an item, the honest answer is that you are not ready for Conditional status yet. That is a worse position than you wanted, but it is not a fraud exposure.

2. Anything that is genuinely not applicable

This is the mistake that actively costs companies points, and I see it constantly.

32 CFR 170.24 defines not-applicable as “a security requirement and/or objective does not apply at the time of the CMMC assessment.” And then it says the thing everybody misses:

“During an assessment, an assessment objective assessed as N/A is equivalent to the same assessment objective being assessed as MET.”

And: “Enduring exceptions when described, along with any mitigations, in the system security plan shall be assessed as MET.”

Not applicable, documented in your SSP with a rationale, scores as MET. Full credit.

So when a company with no wireless infrastructure anywhere puts the wireless requirements on its POA&M “to be safe,” it has just converted a MET into a NOT MET and thrown away points it was entitled to. I have seen this cost a firm the difference between clearing 88 and not clearing it. The fix is free: move it to the SSP with a written rationale.

There is a related distinction in the same section that is even less well known. “Temporary deficiencies that are appropriately addressed in operational plans of action… shall be assessed as MET.” An operational plan of action for a temporary deficiency — a patch in flight, a control briefly degraded during a migration — scores MET. A CMMC POA&M for an unimplemented requirement scores NOT MET.

Two different instruments with opposite scoring consequences and confusingly similar names. Know which one you are writing.

3. Things your provider is actually doing for you

If you use an external service provider or a cloud service provider, 32 CFR 170.19 tells you where that relationship gets documented: “The use of an ESP, its relationship to the OSA, and the services provided need to be documented in the OSA’s SSP and described in the ESP’s service description and customer responsibility matrix (CRM).”

The SSP and the CRM are the designated instruments. Not the POA&M.

The practical rule: read the CRM line by line and sort every requirement into two buckets. If the provider implements it and the CRM documents that, it is assessed against their evidence and can be MET — no POA&M needed. If the CRM assigns it to you and you have not done it, it is your unimplemented requirement, and it goes on the POA&M only if it passes the point gate.

The failure mode I see is a company that never read its CRM, assumed the provider handled everything, and discovered at assessment time that a dozen requirements were assigned to the customer. Those are not POA&M candidates at that point. They are a scoring problem.

I will be honest that the rule does not say in so many words “CRM-covered controls never appear on a POA&M.” That is practitioner reasoning from how the instruments are defined, not a quotable regulation. But I have not seen an assessor disagree with it.

One hard requirement in the same section, since it comes up: where a CUI-handling ESP is a cloud service provider, “the CSP shall meet the FedRAMP requirements in 48 CFR 252.204-7012.” That is not negotiable and not POA&M-able.

The 180-day clock, and what it actually costs you

32 CFR 170.21(b): “The closing of a POA&M must be confirmed by a POA&M closeout assessment within 180-days of the Conditional CMMC Status Date.” Miss it, and “the Conditional CMMC Status for the information system will expire.”

Three details that change how you should plan:

• The clock starts at the Conditional status date — the day of the assessment, not the day you got around to starting remediation.
• Your three-year certification period also runs from the Conditional date. Every day spent remediating is a day off the useful life of the certificate. Six months of POA&M is a sixth of what you paid for.
• An affirmation is required at closeout, on top of the ones at Conditional status, at Final status, and annually thereafter.

Which produces a piece of advice that sounds backwards: a shorter POA&M is worth more than a longer one, and no POA&M is worth most of all. If you are three items away from a clean assessment, fixing them first and going in clean gets you a full three-year certificate instead of a two-and-a-half-year one with an audit obligation in the middle.

An honest open question

The July 13, 2026 suspension of CMMC Phase II did not change any POA&M rule. 32 CFR 170.21 is untouched, 170.22 affirmations are untouched, DFARS 252.204-7012 and all 110 NIST SP 800-171 Rev. 2 requirements are untouched. What was suspended is the third-party certification assessment as a condition of award.

But there is a question nobody has answered, and I would rather flag it than guess: what happens to a 180-day clock that was already running? If you achieved Conditional status in the spring and your closeout window runs into the fall, is that clock tolled, extended, or unaffected? The suspension memoranda do not address it. Multiple law firms have noted the same gap.

If that describes you, do not assume the pause bought you time. Talk to your contracting officer and get an answer in writing, and keep remediating on the original schedule in the meantime.

The one-sentence version

A POA&M is a short, funded, dated commitment to fix a small number of low-weight requirements within six months — not a parking lot for everything you have not gotten to.

Everything else has a home. Not applicable goes in the SSP and scores as MET. Provider-implemented controls go in the SSP and the CRM. Temporary deficiencies go in an operational plan of action and score as MET. Things you cannot fund and cannot schedule are not POA&M items — they are the reason you are not ready yet, and saying so is the cheapest thing you will ever do.

---

Where to go next

• Want to know how many POA&M items you would be looking at? Take the CMMC readiness quiz.
• Our CMMC guide for small contractors covers scoping, scoring and documentation in order.
• The SSP is the document you cannot POA&M. Our CMMC packets give you a real one to build from.
• The POA&M template that matches this structure ships in the Level 2 packet.