A Plan of Action and Milestones is where an honest gap analysis turns into a schedule. Requirement 3.12.2 of NIST SP 800-171 requires one, and every SPRS score below 110 should be backed by one. But the POA&M is also where many organizations get into trouble — listing five-point controls that cannot be deferred, setting dates nobody tracks, or carrying the same items for years.
This service builds a POA&M that respects the eligibility rules, assigns real owners and milestones, and is tracked to closure. For a blank structure you can use yourself, see the free POA&M template.
The eligibility rules
Under 32 CFR 170.21, which governs POA&Ms for CMMC assessments, the general rule is that only requirements worth one point may be placed on a POA&M. There is one exception: 3.13.11 may be deferred when encryption is in place but is not FIPS-validated — the partial-credit condition worth three points.
Six requirements can never be deferred regardless of point value: AC.L2-3.1.20 (external connections), AC.L2-3.1.22 (CUI on publicly accessible systems), CA.L2-3.12.4 (the System Security Plan), PE.L2-3.10.3 (escorting visitors), PE.L2-3.10.4 (physical access logs) and PE.L2-3.10.5 (physical access devices).
The threshold and the clock
Conditional Level 2 status requires a score of at least 88 — that is, 0.8 × 110 — with every remaining gap on an eligible POA&M. The POA&M must then be closed out within 180 days. Failing to close it ends the conditional status.
Those rules apply to CMMC assessments, which are paused for now (see program status). For self-assessments posted to SPRS under DFARS 252.204-7019, a POA&M is still required for any requirement not yet implemented, and planning to the CMMC rule now means you will not have to restructure the plan when assessments resume.
How we build the plan
- Start from a scored gap analysis — see CMMC gap assessment — so every open requirement has a point value.
- Separate deferrable items from those that must be fixed before any assessment, and schedule the second group first.
- Order remediation by points recovered per unit of effort, so the score rises fastest where it costs least.
- Give each item an owner, the specific objectives it closes, interim milestones, resources and a target date.
- Record the evidence that will prove closure, so items can be verified rather than simply marked done.
What a defensible POA&M entry contains
| Field | Why it matters |
|---|---|
| Requirement and objective IDs | Ties the gap to exactly what will be tested |
| Point value and eligibility | Shows the item may lawfully be deferred |
| Weakness description | States what is missing, not just the control title |
| Owner | One named person, not a department |
| Milestones and dates | Interim steps that can be checked |
| Resources required | Budget, tools or people needed to finish |
| Closure evidence | The artifact that will prove completion |
| Status history | Shows the plan is tracked over time |
Prioritizing by points recovered
Not all gaps are equal. A missing MFA implementation costs five points; a missing login banner costs one. When budget and time are limited, sequence the work so that each week of effort recovers the most points, while still fixing the never-deferrable items first. A typical first pass closes the five-point items that need configuration rather than new purchases — session lock, account lockout, disabling unused services — then moves to the five-pointers that need projects, such as FIPS-validated encryption or a central log platform.
We show this as a projected score curve: the SPRS score today, after each milestone, and at closeout. Leadership can see what each investment buys, and a prime or reviewer can see a credible path rather than a list.
Tracking to closure
A POA&M that never shrinks is a red flag to any reviewer. We review progress monthly, re-score the SPRS figure as items close, and update the SSP when a requirement moves from partially to fully implemented. Clients on managed services have this tracking handled continuously.
Frequently asked questions
Can we put MFA (3.5.3) on a POA&M?
Not under the CMMC rule. 3.5.3 is a five-point requirement with partial credit at three points, and only 3.13.11 has a partial-credit exception for deferral. MFA has to be implemented.
How long can an item stay on a POA&M for a self-assessment?
DFARS 252.204-7019 does not set a closeout period for self-assessments, but open items reduce your posted score and must be supportable. Treat 180 days as the working standard.
Does a POA&M raise our SPRS score?
No. The score reflects what is implemented today. The POA&M shows when the score will rise.
Who should own the POA&M?
One accountable person, usually the owner of the SSP, with each item assigned to the person who will actually do the work. Review it with leadership monthly.