What is a CMMC POA&M?
A POA&M (Plan of Action & Milestones) is the document that lists every unimplemented or partially-implemented NIST SP 800-171 control, the plan to close it, the owner, the milestones, and the evidence that will prove closure. Under CMMC Level 2, the POA&M is one of the three artifacts a C3PAO reads on assessment day, and it is the basis for any Conditional Level 2 certification. A weak POA&M is the single most common reason a contractor gets a Conditional status instead of Final certification.
Why manual POA&Ms break
The typical contractor maintains the POA&M as a separate spreadsheet — separate from the SSP, separate from the live evidence ledger, separate from the SPRS scoring sheet. Every quarterly review requires reconciling four sources that were last edited by different people. Items close in the spreadsheet that are still open in the evidence ledger. The SPRS score deducts for controls the POA&M says are remediated. The assessor catches the inconsistency in the first hour of the interview.
The other breakage point is the closure evidence. A manual POA&M records "closed" as a status field; it does not record what evidence closed the item, who approved the closure, or when. Reconstructing the chain six months later for a DIBCAC audit is impossible.
What Athena's POA&M management does
- Auto-generation from open objectives. Every unimplemented NIST SP 800-171A objective creates a POA&M item with a default owner, milestone schedule, hour estimate, and citations to the evidence that triggered it.
- Milestone tracking. Each item carries milestones with due dates and owners. Slipped milestones trigger reviewer alerts before the C3PAO sees them.
- Evidence-backed closure. Items close only when the closing evidence is linked, hashed, and a reviewer signs off. No "status flipped to closed" without a trail.
- Live SPRS impact. The SPRS score updates the moment an item closes. The Affirming Official always sees the current number.
- Conditional Level 2 readiness. Tracks which items qualify for the 180-day deferral window and flags high-weight controls that cannot be deferred.
- Audit trail on every change. Who opened the item, who edited it, who closed it, and on what evidence — preserved for the assessor.
How POA&M management ties into the rest of the workflow
POA&M items are created from gaps in the SSP, closed against the live evidence ledger, and weighted into the SPRS score. When the package ships to the C3PAO, the POA&M is bundled into the eMASS submission with cryptographic provenance on every closure. The workflow automation pillar shows the end-to-end loop.
Buyer checklist for POA&M management
- Auto-generates items from open NIST SP 800-171A objectives, not free-text entries.
- Tracks milestones, owners, and hour estimates per item.
- Requires evidence + reviewer sign-off to close an item — no status flips.
- Live SPRS impact as items close.
- Flags high-weight controls that cannot be deferred under Conditional Level 2.
- Full audit trail per item, exportable into the eMASS package.