What a CMMC POA&M is
A POA&M is a per-control action plan. For each unmet requirement it records what the gap is, who owns fixing it, what the remediation approach is, what evidence will prove closure, and when it will be done. Under CMMC Level 2 you have 180 days from the assessment to close every POA&M item and reach a Final CMMC L2 status.
Skip the manual POA&M drafting.
Run the free Quick Score to identify your gaps in ~60 seconds. Athena drafts your POA&M line-items straight from the real assessment findings.
Start the free Quick ScoreThe DoD-format POA&M fields
CMMC POA&Ms follow the same field structure the DoD has used across DFARS 7012 self-assessments and DIBCAC reviews. Every line item should carry, at minimum:
| Field | Purpose |
|---|---|
| Control ID | The NIST 800-171 requirement (e.g. 3.1.1, 3.5.3). |
| Weakness / gap | Which objectives from 800-171A are not currently met, and why. |
| Point value | 1, 3, or 5 per DoD Assessment Methodology weighting. |
| Point of contact | Named owner responsible for closing the gap. |
| Resources required | Tools, budget, headcount, or third-party services needed. |
| Scheduled completion date | Target close date (must fall inside the 180-day window). |
| Milestones | Intermediate checkpoints with dates. |
| Milestone changes | Audit trail of slippage — assessors read this. |
| Evidence at closure | The artifact(s) that will prove the objective is now met. |
| Status | Ongoing / Risk-Accepted / Completed. |
What you CAN'T POA&M
Not every unmet control can go on a POA&M at CMMC L2. The rules that matter:
- Your SPRS score must be at least 88 (out of 110) at the time of assessment. Below 88, POA&Ms don't rescue you — you don't get a Conditional status.
- The highest-weighted (5-point) controls generally cannot be POA&M'd. Missing one of those and you don't earn a Conditional status regardless of overall score.
- All 1-point controls are typically POA&M-eligible, and many 3-point controls are — but check the current DoD Assessment Methodology and CMMC rule text for the definitive list on the day you assess.
- Every open POA&M item must be closed within 180 days to convert Conditional → Final. Missing the 180-day deadline invalidates the CMMC status.
POA&M eligibility rules have evolved across CMMC drafts. Always confirm against the current 32 CFR Part 170 rule text and DoD Assessment Methodology at assessment time.
Example POA&M template structure
A minimum-viable CMMC POA&M line looks like this:
Control ID : 3.10.5
Requirement : Control and manage physical access devices.
Weakness : Physical access devices (badges, keys, keycards) are
issued to staff but the organization does not maintain
a current inventory and there is no documented
procedure for retrieving devices at termination.
Objectives unmet : 3.10.5[a] (devices identified),
3.10.5[c] (devices managed)
Point value : 1
Owner : R. Nguyen, Facilities & Physical Security Lead
Resources : Badge management system export, HR offboarding
checklist update, quarterly reconciliation SOP
Milestones : 2026-08-01 draft device inventory + issuance log
2026-08-15 add badge-return step to offboarding
2026-09-01 first quarterly reconciliation complete
Scheduled close : 2026-09-15
Evidence at close: Physical access device inventory (CSV),
HR offboarding checklist w/ badge-return step,
Q3 reconciliation report signed by facilities lead
Status : OngoingMultiply that across every unmet objective and you have your CMMC POA&M. In Athena, this line is generated automatically from the assessment findings and linked to the evidence that will close it.
Generate your POA&M from real gaps.
Start with the free Quick Score to surface unmet objectives, then upgrade to the $129 Readiness Snapshot to export a full DoD-format POA&M with evidence links.
- All 110 controls
- SPRS score projection
- No signup required