POA&M basics

What Is a POA&M (POAM)?

POA&M stands for Plan of Action and Milestones. It is the document that records a known security weakness, the plan to fix it, who owns the fix, and the dates it will be done by — see the NIST glossary definition.

In CMMC, a POA&M has a second, stricter meaning: it is the mechanism that lets a Level 2 assessment end in Conditional status instead of a failure — but only under the rules of 32 CFR 170.21.

By Doug Majewski, President, Athena Consulting Group, LLC · Last reviewed: October 19, 2026

Open the POA&M generator CMMC POA&M template

Where the POA&M requirement comes from

For defense contractors, NIST SP 800-171 Rev. 2 requirement 3.12.2 requires developing and implementing plans of action to correct deficiencies found during security assessments. So the POA&M is not optional paperwork — maintaining one is itself an assessed requirement.

What a POA&M entry contains

Each entry tracks one weakness from discovery to closure:

the weakness or deficiency, tied to the requirement it fails
the owner responsible for the fix
the resources required
the remediation approach and milestones, each with a date
the current status

A minimal example (fictional):

Weakness	Requirement	Owner	Milestone	Status
Example: MFA not enabled for remote users	3.5.3	IT Manager	Enable MFA for all remote access by 2026-12-15	In progress

POA&Ms beyond CMMC

POA&Ms are used across federal security programs: FedRAMP cloud authorizations maintain POA&Ms for open weaknesses (fedramp.gov), and the DoD Risk Management Framework uses them to track corrective actions for authorizations. The format varies by program; the purpose — a tracked, dated plan to close a known weakness — is the same.

The CMMC POA&M rules

At a CMMC Level 2 assessment, a POA&M can convert a failing score into Conditional CMMC Status — but only if all of these hold (32 CFR 170.21):

the assessment score is at least 88 out of 110 (0.8 × 110);
every POA&M item is a 1-point requirement — with one exception, SC.L2-3.13.11, when encryption is used but is not FIPS-validated;
none of the six never-eligible requirements is NOT MET (3.1.20, 3.1.22, 3.12.4, 3.10.3, 3.10.4, 3.10.5);
every item is closed within 180 days of the Conditional CMMC Status Date.

The full walkthrough, with the eligibility table, is the CMMC POA&M template.

Operational POA&M vs CMMC assessment POA&M

These are two different things with the same name. Your operational POA&M (requirement 3.12.2) is the living document you maintain year-round to track and fix deficiencies — an assessor will ask to see it. The CMMC assessment POA&M is the formal artifact created at the end of a Level 2 assessment that scores at least 88, listing the specific NOT MET items that must close within 180 days. A healthy operational POA&M is how you avoid needing the assessment one.

Frequently asked questions

What does POA&M stand for?

Plan of Action and Milestones. It documents a known security weakness, the plan to correct it, the owner, the resources, and the milestone dates.

What is a POA&M in cybersecurity?

A tracked corrective-action plan for security deficiencies. NIST SP 800-171 requirement 3.12.2 requires contractors to maintain one, and programs like FedRAMP and the DoD RMF use POA&Ms to track open weaknesses through closure.

Can every gap go on a CMMC POA&M?

No. Under 32 CFR 170.21, only 1-point requirements are POA&M-eligible (plus SC.L2-3.13.11 when encryption is used but not FIPS-validated); six requirements — 3.1.20, 3.1.22, 3.12.4, 3.10.3, 3.10.4, 3.10.5 — can never be on a POA&M; the score must be at least 88; and all items must close within 180 days.