POA&M reference

CMMC POA&M Template, and What Can (and Can't) Be on a POA&M

Download (CSV): Level 2 requirements and POA&M eligibility

New to POA&Ms? Start with What is a POA&M? — this page is the CMMC-specific rules.

A CMMC POA&M lets a Level 2 assessment end in Conditional status. It only works if three things are true: the assessment score is at least 0.8 of the 110 requirements (88 points), every POA&M item is a 1-point requirement (SC.L2-3.13.11 is the one exception), and none of six prohibited requirements is NOT MET. Each item must then be closed within 180 days of the Conditional CMMC Status Date.

POA&M eligibility exceptions (CSV)

By Doug Majewski, President, Athena Consulting Group, LLC · Last reviewed: October 17, 2026

Open the POA&M generator

POA&M items

A plan is not implementation: deductions remain until the requirement is implemented. Eligibility warnings appear beside each item.

0 items · 0 points still deducted

No items yet. Add one and pick the requirement — eligibility and scoring impact are filled in for you.

Sign in to save your workOpen POA&M Manager · workspace access required

What a POA&M does and does not do

SPRS scoring: a requirement on a POA&M is still not implemented. The deduction stays in your score until the requirement is actually implemented. A POA&M never converts Not Met into Met.

CMMC conditional status: that is a separate concept. Under 32 CFR 170.21 only certain requirements may sit on a POA&M at all — broadly, those with a point value of 1 — and several are explicitly prohibited regardless of point value. Conditional status also carries a minimum score threshold and a 180-day closeout window from the status date.

Distinguish the two clearly in your own documentation: the self-assessment score you report in SPRS, and the eligibility rules that govern a CMMC conditional status.

Sanitized example

Fictional contractor "Northgate Precision LLC". No real system names, hostnames, IPs, or findings — deliberately generic so it is safe to share.

AC.L2-3.1.3 — Weakness: "CUI flow between the engineering share and the front office is not restricted by rule." Owner: IT Manager. Target: 90 days. Status: In progress. Milestones: "define allowed flows (30d) → implement rules (60d) → verify with rule export (90d)." Scoring category 1-point, POA&M eligible.

AC.L2-3.1.22 — flagged not eligible: it is explicitly prohibited from a POA&M by 32 CFR 170.21(a)(2)(iii) even though it is a 1-point requirement, so it must be MET.

One path forward

Free result → 7-day free trial → Athena workspace

  1. Free, right now: keep the result and downloads from this tool. No account, no e-mail required.
  2. 7-day free trial: full Compliance Pro access at sign-up, no card required, no automatic charge.
  3. Athena workspace / evidence sprint: continuous objective-level tracking, evidence defensibility scoring, and assessor-ready artifacts.
Start free for 7 days See the Athena workspace

Athena works at the assessment-objective level, keeps a provenance trail for every artifact, and scores how defensible your evidence is. We do not guarantee a certification outcome — no tool or consultant can.

Official primary references

The other free CMMC tools

SPRS score calculator

Score all 110 requirements with official weighted deductions.

Level 2 self-assessment

Met / Not Met / N/A across 110 requirements with a gap report.

320-objective evidence checklist

Every NIST SP 800-171A Rev. 2 objective with evidence planning.

CMMC scoping tool

Categorize assets and define your assessment boundary.

C3PAO assessment prep

Day-one evidence list, mock intake, and readiness verdict.

Educational readiness aid. This is not legal advice, not an official assessment, not a certification, and not a submitted SPRS score. Your assessment results and any affirmation remain your organization's responsibility.

What a CMMC POA&M is

32 CFR 170.4 defines a Plan of Action and Milestones (POA&M) as "a document that identifies tasks needing to be accomplished". It also records the resources required, the milestones, and the scheduled completion dates. In practice it is a per-requirement action plan. For each NOT MET requirement it records:

  • the gap
  • the role that owns the fix
  • the remediation approach
  • the evidence that will prove closure
  • the completion date

Three rules shape everything else on this page:

  • A POA&M does not turn NOT MET into MET. 32 CFR 170.24 is explicit: a requirement that isn't implemented is scored NOT MET whether or not it is on a POA&M. The deduction stays in your score until the requirement is actually implemented.
  • Level 1 never gets a POA&M. 32 CFR 170.21(a)(1) doesn't permit one for a Level 1 self-assessment. All 15 Level 1 requirements must be MET.
  • The clock runs from the status date, not the assessment. At Level 2 you have 180 days from the Conditional CMMC Status Date to close every POA&M item through a POA&M closeout assessment and reach Final status (32 CFR 170.21(b)).

What can (and can't) be on a CMMC POA&M: 32 CFR 170.21

Conditional Level 2 status depends on three gates in 32 CFR 170.21(a)(2). Fail any one and the result is no CMMC status, not Conditional status.

Gate 1: minimum score

Your assessment score divided by the total number of Level 2 requirements must be at least 0.8 (170.21(a)(2)(i)). Level 2 is identical to NIST SP 800-171 Rev. 2, which has 110 requirements (170.14(c)(3)). That makes the floor 88. The score is calculated with the POA&M items still deducted.

Gate 2: point value of 1 only, with one exception

No requirement with a point value above 1 may be on a POA&M (170.21(a)(2)(ii)). That rules out every 3- and 5-point requirement in the CMMC scoring methodology (32 CFR 170.24).

  • The exception: SC.L2-3.13.11 (CUI encryption).
    • If encryption is employed but is not FIPS-validated, the requirement scores a 3-point deduction and may still go on the POA&M.
    • If no encryption is employed, it scores 5 and may not (170.21(a)(2)(ii); 170.24(c)(2)(i)(B)(4)(ii)).
  • No exception for MFA. IA.L2-3.5.3 scores 3 points (MFA for remote and privileged users only) or 5 points (none). It is never 1 point, so it can never be on a POA&M (170.24(c)(2)(i)(B)(4)(i)).

Gate 3: six requirements that can never be on a POA&M, even at 1 point

170.21(a)(2)(iii) excludes these outright. They must be MET at assessment:

CMMC IDRequirement
AC.L2-3.1.20External connections
AC.L2-3.1.22Control publicly posted CUI
CA.L2-3.12.4System security plan. Without a current SSP the assessment can't be completed at all (170.24(c)(2)(i)(B)(5)).
PE.L2-3.10.3Escort visitors
PE.L2-3.10.4Physical access logs
PE.L2-3.10.5Manage physical access devices

Can [requirement] be on a POA&M? Quick lookup

All 110 Level 2 requirements, checked against 32 CFR 170.21 and the point values in 32 CFR 170.24. Filter by ID (e.g. "3.3.4"), family (e.g. "AC") or keyword. Under the rule, 46 requirements can be on a POA&M, 1 only under the FIPS exception, and the other 63 cannot.

CMMC IDRequirementPoint value (32 CFR 170.24)Can it be on a CMMC POA&M?BasisEvidence guide
AC.L2-3.1.1Authorized users/devices5No: point value above 1170.21(a)(2)(ii)Evidence guide
AC.L2-3.1.2Authorized transactions and functions5No: point value above 1170.21(a)(2)(ii)Evidence guide
AC.L2-3.1.3Control CUI flow1Yes1 point, 170.21(a)(2)(ii)— All guides
AC.L2-3.1.4Separation of duties1Yes1 point, 170.21(a)(2)(ii)— All guides
AC.L2-3.1.5Least privilege3No: point value above 1170.21(a)(2)(ii)— All guides
AC.L2-3.1.6Use non-privileged accounts1Yes1 point, 170.21(a)(2)(ii)— All guides
AC.L2-3.1.7Prevent non-privileged execution of privileged functions1Yes1 point, 170.21(a)(2)(ii)— All guides
AC.L2-3.1.8Limit unsuccessful logon attempts1Yes1 point, 170.21(a)(2)(ii)— All guides
AC.L2-3.1.9Privacy and security notices1Yes1 point, 170.21(a)(2)(ii)— All guides
AC.L2-3.1.10Session lock1Yes1 point, 170.21(a)(2)(ii)— All guides
AC.L2-3.1.11Automatic session termination1Yes1 point, 170.21(a)(2)(ii)— All guides
AC.L2-3.1.12Monitor and control remote access sessions5No: point value above 1170.21(a)(2)(ii)— All guides
AC.L2-3.1.13Cryptographic protection for remote access5No: point value above 1170.21(a)(2)(ii)— All guides
AC.L2-3.1.14Route remote access through managed access control points1Yes1 point, 170.21(a)(2)(ii)— All guides
AC.L2-3.1.15Authorize remote privileged commands and access1Yes1 point, 170.21(a)(2)(ii)— All guides
AC.L2-3.1.16Authorize wireless access5No: point value above 1170.21(a)(2)(ii)— All guides
AC.L2-3.1.17Protect wireless access5No: point value above 1170.21(a)(2)(ii)— All guides
AC.L2-3.1.18Control connection of mobile devices5No: point value above 1170.21(a)(2)(ii)— All guides
AC.L2-3.1.19Encrypt CUI on mobile devices3No: point value above 1170.21(a)(2)(ii)— All guides
AC.L2-3.1.20Verify and control external connections1No: prohibited170.21(a)(2)(iii)Evidence guide
AC.L2-3.1.21Limit use of portable storage on external systems1Yes1 point, 170.21(a)(2)(ii)— All guides
AC.L2-3.1.22Control publicly accessible CUI1No: prohibited170.21(a)(2)(iii)— All guides
AT.L2-3.2.1Security awareness for managers/admins/users5No: point value above 1170.21(a)(2)(ii)— All guides
AT.L2-3.2.2Role-based security training5No: point value above 1170.21(a)(2)(ii)— All guides
AT.L2-3.2.3Insider threat awareness training1Yes1 point, 170.21(a)(2)(ii)— All guides
AU.L2-3.3.1Create and retain audit logs5No: point value above 1170.21(a)(2)(ii)Evidence guide
AU.L2-3.3.2Audit record content3No: point value above 1170.21(a)(2)(ii)— All guides
AU.L2-3.3.3Review and update auditable events1Yes1 point, 170.21(a)(2)(ii)— All guides
AU.L2-3.3.4Alert on audit logging failure1Yes1 point, 170.21(a)(2)(ii)— All guides
AU.L2-3.3.5Correlate audit review/analysis/reporting5No: point value above 1170.21(a)(2)(ii)— All guides
AU.L2-3.3.6Audit reduction and report generation1Yes1 point, 170.21(a)(2)(ii)— All guides
AU.L2-3.3.7Time synchronization for audit records1Yes1 point, 170.21(a)(2)(ii)— All guides
AU.L2-3.3.8Protect audit information and tools1Yes1 point, 170.21(a)(2)(ii)— All guides
AU.L2-3.3.9Limit audit management to privileged users1Yes1 point, 170.21(a)(2)(ii)— All guides
CM.L2-3.4.1Baseline configurations and inventories5No: point value above 1170.21(a)(2)(ii)Evidence guide
CM.L2-3.4.2Enforce security configuration settings5No: point value above 1170.21(a)(2)(ii)Evidence guide
CM.L2-3.4.3Change control1Yes1 point, 170.21(a)(2)(ii)— All guides
CM.L2-3.4.4Security impact analysis for changes1Yes1 point, 170.21(a)(2)(ii)— All guides
CM.L2-3.4.5Access restrictions for changes5No: point value above 1170.21(a)(2)(ii)— All guides
CM.L2-3.4.6Least functionality5No: point value above 1170.21(a)(2)(ii)— All guides
CM.L2-3.4.7Restrict nonessential programs/services/ports/protocols5No: point value above 1170.21(a)(2)(ii)— All guides
CM.L2-3.4.8Allow-by-exception or deny-by-exception software control5No: point value above 1170.21(a)(2)(ii)— All guides
CM.L2-3.4.9Control user-installed software1Yes1 point, 170.21(a)(2)(ii)— All guides
IA.L2-3.5.1Identify users, processes, and devices5No: point value above 1170.21(a)(2)(ii)Evidence guide
IA.L2-3.5.2Authenticate identities5No: point value above 1170.21(a)(2)(ii)Evidence guide
IA.L2-3.5.3Multi-factor authentication3 or 5No: point value above 1170.21(a)(2)(ii)Evidence guide
IA.L2-3.5.4Replay-resistant authentication1Yes1 point, 170.21(a)(2)(ii)— All guides
IA.L2-3.5.5Prevent reuse of identifiers1Yes1 point, 170.21(a)(2)(ii)— All guides
IA.L2-3.5.6Disable identifiers after inactivity1Yes1 point, 170.21(a)(2)(ii)— All guides
IA.L2-3.5.7Password complexity1Yes1 point, 170.21(a)(2)(ii)— All guides
IA.L2-3.5.8Password reuse limits1Yes1 point, 170.21(a)(2)(ii)— All guides
IA.L2-3.5.9Temporary passwords for immediate change1Yes1 point, 170.21(a)(2)(ii)— All guides
IA.L2-3.5.10Cryptographically protected passwords5No: point value above 1170.21(a)(2)(ii)— All guides
IA.L2-3.5.11Obscure authentication feedback1Yes1 point, 170.21(a)(2)(ii)— All guides
IR.L2-3.6.1Incident handling capability5No: point value above 1170.21(a)(2)(ii)Evidence guide
IR.L2-3.6.2Track, document, and report incidents5No: point value above 1170.21(a)(2)(ii)Evidence guide
IR.L2-3.6.3Test incident response1Yes1 point, 170.21(a)(2)(ii)— All guides
MA.L2-3.7.1Perform maintenance3No: point value above 1170.21(a)(2)(ii)— All guides
MA.L2-3.7.2Control maintenance tools, techniques, personnel5No: point value above 1170.21(a)(2)(ii)— All guides
MA.L2-3.7.3Sanitize equipment removed for off-site maintenance1Yes1 point, 170.21(a)(2)(ii)— All guides
MA.L2-3.7.4Check maintenance media for malicious code3No: point value above 1170.21(a)(2)(ii)— All guides
MA.L2-3.7.5MFA for nonlocal maintenance sessions5No: point value above 1170.21(a)(2)(ii)— All guides
MA.L2-3.7.6Supervise maintenance personnel without authorization1Yes1 point, 170.21(a)(2)(ii)— All guides
MP.L2-3.8.1Protect system media3No: point value above 1170.21(a)(2)(ii)— All guides
MP.L2-3.8.2Limit access to media3No: point value above 1170.21(a)(2)(ii)— All guides
MP.L2-3.8.3Sanitize or destroy media before disposal/reuse5No: point value above 1170.21(a)(2)(ii)Evidence guide
MP.L2-3.8.4Mark media with CUI markings1Yes1 point, 170.21(a)(2)(ii)— All guides
MP.L2-3.8.5Protect media during transport1Yes1 point, 170.21(a)(2)(ii)— All guides
MP.L2-3.8.6Cryptographic protection for digital media in transport1Yes1 point, 170.21(a)(2)(ii)— All guides
MP.L2-3.8.7Control removable media5No: point value above 1170.21(a)(2)(ii)— All guides
MP.L2-3.8.8Prohibit portable storage with no identifiable owner3No: point value above 1170.21(a)(2)(ii)— All guides
MP.L2-3.8.9Protect backup CUI at storage locations1Yes1 point, 170.21(a)(2)(ii)— All guides
PS.L2-3.9.1Screen individuals before authorizing access3No: point value above 1170.21(a)(2)(ii)— All guides
PS.L2-3.9.2Protect CUI during personnel actions5No: point value above 1170.21(a)(2)(ii)— All guides
PE.L2-3.10.1Limit physical access to systems/facilities5No: point value above 1170.21(a)(2)(ii)— All guides
PE.L2-3.10.2Protect and monitor physical access5No: point value above 1170.21(a)(2)(ii)— All guides
PE.L2-3.10.3Escort visitors and monitor visitor activity1No: prohibited170.21(a)(2)(iii)— All guides
PE.L2-3.10.4Maintain physical access audit logs1No: prohibited170.21(a)(2)(iii)— All guides
PE.L2-3.10.5Manage and protect physical access devices1No: prohibited170.21(a)(2)(iii)— All guides
PE.L2-3.10.6Protect transmission lines and output devices1Yes1 point, 170.21(a)(2)(ii)— All guides
RA.L2-3.11.1Periodic risk assessments3No: point value above 1170.21(a)(2)(ii)— All guides
RA.L2-3.11.2Vulnerability scanning5No: point value above 1170.21(a)(2)(ii)Evidence guide
RA.L2-3.11.3Remediate vulnerabilities1Yes1 point, 170.21(a)(2)(ii)— All guides
CA.L2-3.12.1Periodic security assessments5No: point value above 1170.21(a)(2)(ii)Evidence guide
CA.L2-3.12.2Develop and implement POA&Ms3No: point value above 1170.21(a)(2)(ii)Evidence guide
CA.L2-3.12.3Continuous monitoring5No: point value above 1170.21(a)(2)(ii)— All guides
CA.L2-3.12.4System Security Plan (SSP)No point value (assessment can't be completed without it)No: prohibited170.21(a)(2)(iii)Evidence guide
SC.L2-3.13.1Boundary protection5No: point value above 1170.21(a)(2)(ii)Evidence guide
SC.L2-3.13.2Secure architecture and engineering principles5No: point value above 1170.21(a)(2)(ii)Evidence guide
SC.L2-3.13.3Separate user and system management functionality1Yes1 point, 170.21(a)(2)(ii)— All guides
SC.L2-3.13.4Prevent transfer via shared system resources1Yes1 point, 170.21(a)(2)(ii)— All guides
SC.L2-3.13.5Public system separation/subnetworks5No: point value above 1170.21(a)(2)(ii)Evidence guide
SC.L2-3.13.6Deny network traffic by default; allow by exception5No: point value above 1170.21(a)(2)(ii)— All guides
SC.L2-3.13.7Prevent split tunneling1Yes1 point, 170.21(a)(2)(ii)— All guides
SC.L2-3.13.8Protect CUI in transit3No: point value above 1170.21(a)(2)(ii)Evidence guide
SC.L2-3.13.9Terminate network connections1Yes1 point, 170.21(a)(2)(ii)— All guides
SC.L2-3.13.10Cryptographic key management1Yes1 point, 170.21(a)(2)(ii)— All guides
SC.L2-3.13.11FIPS-validated cryptography3 or 5Only if encryption is employed but not FIPS-validated170.21(a)(2)(ii) exceptionEvidence guide
SC.L2-3.13.12Collaborative computing device control1Yes1 point, 170.21(a)(2)(ii)— All guides
SC.L2-3.13.13Control and monitor mobile code1Yes1 point, 170.21(a)(2)(ii)— All guides
SC.L2-3.13.14Control and monitor VoIP1Yes1 point, 170.21(a)(2)(ii)— All guides
SC.L2-3.13.15Protect communications session authenticity5No: point value above 1170.21(a)(2)(ii)— All guides
SC.L2-3.13.16Protect CUI at rest1Yes1 point, 170.21(a)(2)(ii)— All guides
SI.L2-3.14.1Identify, report, and correct flaws5No: point value above 1170.21(a)(2)(ii)Evidence guide
SI.L2-3.14.2Malicious code protection5No: point value above 1170.21(a)(2)(ii)Evidence guide
SI.L2-3.14.3Security alerts and advisories5No: point value above 1170.21(a)(2)(ii)— All guides
SI.L2-3.14.4Update malicious code protection5No: point value above 1170.21(a)(2)(ii)— All guides
SI.L2-3.14.5Perform periodic and real-time scans3No: point value above 1170.21(a)(2)(ii)— All guides
SI.L2-3.14.6Monitor inbound/outbound traffic and detect attacks5No: point value above 1170.21(a)(2)(ii)Evidence guide
SI.L2-3.14.7Identify unauthorized system use3No: point value above 1170.21(a)(2)(ii)— All guides

Eligible on paper ≠ safe to defer. Every eligible item still costs its point. Twenty-three open 1-point items take a perfect 110 down to 87, which is below the floor. Plan the POA&M around the score, not just the eligibility column.

Rules as codified in 32 CFR 170.21 and 170.24 (eCFR, current as of 15 October 2026).

The 180-day clock: Conditional status, closeout, and expiry

The clock starts on the Conditional CMMC Status Date, not the assessment date. 32 CFR 170.4 defines the CMMC Status Date as the date the results are submitted to SPRS (Level 2 Self) or to the CMMC instantiation of eMASS (Level 2 C3PAO). When a POA&M closeout succeeds, the Final status keeps the Conditional date. No new date is set.

Who performs the POA&M closeout assessment

Status soughtCloseout performed byWhat is assessedSource
Final Level 2 (Self)The OSA, as a POA&M closeout self-assessment, done the same way as the initial self-assessmentOnly the NOT MET requirements that were on the POA&M170.21(b)(1); 170.4
Final Level 2 (C3PAO)An authorized or accredited C3PAOOnly the NOT MET requirements that were on the POA&M170.21(b)(2); 170.4
Final Level 3 (DIBCAC)DCMA DIBCACOnly the NOT MET requirements that were on the POA&M170.21(b)(3); 170.4

What closeout requires for Level 2 (Self)

  1. Remediate every NOT MET requirement on the POA&M.
  2. Perform the POA&M closeout self-assessment.
  3. Post the compliance results to SPRS within 180 days of the CMMC Status Date (170.16(a)(1)(ii)(B)). The SPRS entry carries POA&M usage and compliance status (170.16(a)(1)(i)).
  4. Have the Affirming Official submit an affirmation at the completion of the closeout (170.22(a)(3)(iv), (b)(2)).

For Level 2 (C3PAO), the C3PAO posts the closeout results to eMASS within the same 180 days (170.17(a)(1)(ii)(B)). An affirmation follows that closeout too (170.22(b)(3)).

What happens on day 181

The Conditional status expires (170.21(b)). If that happens during a contract's period of performance, two things follow:

  • standard contractual remedies apply
  • the contractor is ineligible for additional awards requiring that CMMC level for the affected information system until it achieves a new CMMC status

This holds for Level 2 (Self) under 170.16(a)(1)(ii)(B) and for Level 2 (C3PAO) under 170.17(a)(1)(ii)(B).

Working backward from day 180

This is planning guidance, not a rule requirement. Count every milestone from the status date, never from the assessment.

Day (from status date)Milestone
Day 0Results posted to SPRS/eMASS. Record the date on every POA&M line.
Day 30Each item has an owner role, an approach and a funded resource.
Day 60Technical changes implemented for most items.
Day 120Every item implemented. The SSP is updated to match.
Day 150Internal dry-run closeout: test each item as the closeout will.
Day 150–170Fix whatever the dry run found. Re-test.
Before Day 180Closeout assessment done, results posted, affirmation submitted.

The DoD-format POA&M fields

This is a practical field set. 32 CFR 170.4 requires a POA&M to identify the tasks, the resources required, the milestones, and the scheduled completion dates. The rows below cover that and add what an assessor will ask for at closeout.

FieldPurpose
Control IDThe CMMC requirement and its NIST SP 800-171 number (e.g. AU.L2-3.3.4 / 3.3.4).
Weakness / gapWhich NIST SP 800-171A assessment objectives are not currently met, and why.
Point valuePer the CMMC scoring methodology (32 CFR 170.24). Items above 1 point can't be on a CMMC POA&M, except SC.L2-3.13.11.
CMMC POA&M eligibilityEligible / Not eligible, with the basis: 170.21(a)(2)(ii) (point value) or 170.21(a)(2)(iii) (prohibited).
Conditional CMMC Status Date and closeout deadlineThe status date, and the status date + 180 days (170.21(b)).
Point of contactThe role responsible for closing the gap (a role, not a person's name).
Resources requiredTools, budget, headcount, or third-party services needed.
Scheduled completion dateTarget close date, within 180 days of the Conditional CMMC Status Date.
MilestonesIntermediate checkpoints, dated relative to the status date.
Milestone changesAudit trail of slippage. Assessors read this.
Evidence at closureThe artifact(s) that will prove each objective is now met.
StatusOpen / In progress / Closed (verified at closeout).

Why there's no "Risk-Accepted" status: the rule requires every NOT MET requirement on the POA&M to be remediated and closed out within 180 days (32 CFR 170.16(a)(1)(ii)(B); 170.21(b)). There is no risk-acceptance path to Final status. A condition that cannot be remediated is an enduring exception documented in the SSP. A temporary deficiency with a fix in progress goes in the operational plan of action (32 CFR 170.4).

Example POA&M template structure

A minimum-viable CMMC POA&M line for an eligible 1-point requirement looks like this. Dates are relative to the Conditional CMMC Status Date ("SD").

Control ID        : AU.L2-3.3.4 (NIST SP 800-171 3.3.4)
Requirement       : Alert in the event of an audit logging process failure.
Point value       : 1 (32 CFR 170.24)
CMMC POA&M        : Eligible (1 point; not on the 170.21(a)(2)(iii) list)
Weakness          : Endpoints and servers forward logs to the central log
                    platform, but no alert fires when a forwarder stops
                    sending or the log store fills. Failures are found
                    only during manual review.
Objectives unmet  : 3.3.4[a] personnel or roles to be alerted on an
                    audit logging process failure are not identified;
                    3.3.4[b] types of audit logging process failures
                    for which alerts are generated are not defined;
                    3.3.4[c] identified roles are not alerted when a
                    failure occurs
Owner (role)      : Security Operations Lead
Resources         : Log platform alerting rules, on-call distribution
                    list, 8 staff-hours
Status date (SD)  : Date results posted to SPRS
Milestones        : SD + 30 days  define failure types and alert recipients
                                  (update audit logging procedure)
                    SD + 60 days  alert rules live for forwarder silence,
                                  storage threshold, agent stop
                    SD + 90 days  simulated forwarder outage; alert
                                  received and ticketed
Scheduled close   : SD + 90 days (deadline SD + 180 days)
Evidence at close : Alert rule export (dated after the change);
                    ticket from the simulated outage showing the alert
                    and the response; updated audit logging / monitoring
                    SOP with the defined failure types and recipients;
                    SSP section for 3.3.4 revised to match
Status            : In progress

Two lines that show how the eligibility rules apply:

Control ID        : PE.L2-3.10.5 (Manage physical access devices)
CMMC POA&M        : NOT ELIGIBLE: prohibited by 32 CFR 170.21(a)(2)(iii),
                    even though it is a 1-point requirement.
Action            : Must be MET before the assessment. Track the fix in
                    your operational plan of action, not the CMMC POA&M.

Control ID        : SC.L2-3.13.11 (FIPS-validated cryptography for CUI)
CMMC POA&M        : ELIGIBLE ONLY IF encryption is employed but the module
                    is not FIPS-validated (3-point deduction).
                    If no encryption is employed (5 points): NOT eligible.

See the SC.L2-3.13.11 FIPS encryption evidence guide for what "employed but not validated" looks like in evidence.

Operational plan of action (3.12.2) vs the CMMC assessment POA&M

People mix these two artifacts up. They are different things with different rules.

CMMC assessment POA&MOperational plan of action
What it listsNOT MET requirements from an assessmentTemporary vulnerabilities and temporary deficiencies
Limits170.21 gates: ≥ 0.8 score, 1-point items only (3.13.11 exception), six prohibitedDefined by the OSA
TimelineClosed within 180 days of the Conditional CMMC Status Date"Does not identify a timeline for remediation" (170.4)
Scoring effectItems stay NOT MET and keep their deductionA temporary deficiency properly addressed here is assessed MET (170.24(b)(1)(ii))

32 CFR 170.4 defines a temporary deficiency as a condition where remediating a discovered deficiency is feasible and a known fix is available or in process. It must be documented in an operational plan of action. 170.24(b)(1)(ii) adds that the plan must show deficiency reviews and progress toward correction for the item to be assessed MET.

The NIST requirement behind this is CA.L2-3.12.2: "develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities" (NIST SP 800-171 Rev. 2, 3.12.2). Assessors examine that process even when your assessment POA&M is empty. CA.L2-3.12.2 is itself a 3-point requirement (170.24(c)(2)(i)(B)(2)). If your plan-of-action process is missing, that gap can't go on the POA&M either.

Evidence for the process: CA.L2-3.12.2 plan of action evidence guide.

How POA&M closeout gets tested (and where it fails)

The closeout assessment covers only the NOT MET requirements that were on the POA&M, but each one is assessed against all of its objectives. Expect the three assessment methods NIST SP 800-171A defines (§2.1):

  • EXAMINE:
    • the closed POA&M line and its milestone-change history
    • the revised SSP section
    • configuration exports or screenshots
    • dated tickets and change records
  • INTERVIEW: the owner role, on how the control now operates day to day, not just how it was fixed.
  • TEST: a live demonstration. For AU.L2-3.3.4, stop a log forwarder and show the alert arrive.

Named artifacts to have ready:

  • POA&M register (CSV), with status date and deadline on every line
  • SSP revision history showing the affected sections updated
  • Closeout self-assessment record (Level 2 Self)
  • SPRS posting confirmation (170.16(a)(1)(ii)(B))
  • Affirming Official affirmation (170.22(b)(2))

Failure patterns. This is practitioner guidance, not rule text:

  1. Closed on paper only. The item is marked closed, but the SSP still describes the old state.
  2. No evidence of operation. The fix landed, but nothing dated after the change shows it working.
  3. Day-179 closeout. There is no time to re-test when the closeout finds a gap.
  4. A prohibited item on the POA&M. One of the six went on the POA&M anyway, so the status was never Conditional in the first place.
  5. Death by 1-pointers. Enough eligible gaps pushed the score under 88.
  6. Wrong start date. The 180 days were counted from the assessment, not the Conditional CMMC Status Date.

Does the CMMC Phase 2 suspension change the POA&M rules?

No change to the rule text so far. On July 13, 2026, the Department of War suspended the November 2026 Phase 2 transition. During the suspension, DoD requirements may designate only CMMC Level 1 (Self) or Level 2 (Self).

The text of 32 CFR 170.21 is unchanged in the eCFR (current as of 15 October 2026). Its POA&M conditions still govern any Conditional Level 2 (Self) status.

Whether a given contract requires a CMMC status at all depends on the clause in that contract. DoD has directed contracting officers to remove Level 2 (C3PAO) and Level 3 (DIBCAC) requirements from active solicitations and, by modification, from existing contracts.

For the live picture, see CMMC status: what's in force today.

Start your POA&M

Check each item against the eligibility table above before it goes on your POA&M. A POA&M records a plan. It does not implement the control, and it isn't an assessment.

Open the POA&M generator →

Prepared by the Athena Consulting Group CMMC practice. Athena is not a C3PAO and does not certify; this page explains the published rules so you can prepare.

Frequently asked questions

What is a POA&M in CMMC?

A Plan of Action and Milestones is a document that identifies the tasks needed to fix NOT MET requirements, with resources, milestones and scheduled completion dates (32 CFR 170.4). At Level 2 it allows Conditional status. You then have 180 days from the Conditional CMMC Status Date to close every item through a POA&M closeout assessment and reach Final status.

Can every CMMC requirement be put on a POA&M?

No. 32 CFR 170.21 sets three gates. Your score must be at least 0.8 of the 110 Level 2 requirements (88). Only 1-point requirements may be on the POA&M, except SC.L2-3.13.11 when encryption is employed but not FIPS-validated. And six requirements are never allowed: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5. Use the lookup table on this page to check a specific requirement.

How long do I have to close a CMMC POA&M?

180 days from the Conditional CMMC Status Date, which is the date results are posted to SPRS or eMASS. If closeout isn't completed in time, Conditional status expires. Standard contractual remedies then apply to current contracts. You can't win new awards needing that status for the affected system until you achieve a new one.

Do I need a POA&M if my SPRS score is already 110?

Not an assessment POA&M: with every requirement MET there are no POA&M items. You still need the plan-of-action process that CA.L2-3.12.2 requires. Temporary deficiencies found later belong in an operational plan of action (32 CFR 170.4), which is assessed separately from the assessment POA&M.

Can Level 1 use a POA&M?

No. 32 CFR 170.21(a)(1) does not permit a POA&M for a Level 1 self-assessment. All 15 Level 1 requirements must be MET.

When does the 180-day clock start?

On the Conditional CMMC Status Date. 32 CFR 170.4 defines it as the date the results are submitted to SPRS or the CMMC instantiation of eMASS, not the date the assessment was performed. A Final status reached through closeout keeps that same date.

What happens if we miss the 180 days?

The Conditional status expires (32 CFR 170.21(b)). If that happens during a contract's period of performance, standard contractual remedies apply. You are also ineligible for additional awards requiring that level for the affected system until you achieve a new CMMC status (170.16(a)(1)(ii)(B) for Level 2 Self; 170.17(a)(1)(ii)(B) for Level 2 C3PAO).

Further reading

Related Athena pages and authoritative external references.

On Athena

Authoritative external sources

Related control evidence guides