POA&M Best Practices for CMMC

If you’re working toward Cybersecurity Maturity Model Certification (CMMC) compliance, you’ve likely encountered the term Plan of Action and Milestones (POA&M) or POA&M. Maybe your consultant mentioned it, or you saw it referenced in Department of Defense (DoD) documentation. The Plan of Action and Milestones—that’s what POA&M stands for—is a critical document that can make the difference between passing and failing your CMMC assessment.

But here’s what many defense contractors get wrong: they treat the POA&M as a dumping ground for every security gap they haven’t addressed. That approach doesn’t work under CMMC. This guide explains what a POA&M actually is, how it functions within the CMMC framework, and the best practices that will help you use this tool effectively.

What Is a Plan of Action and Milestones?

A Plan of Action and Milestones is a formal document that identifies security weaknesses in your organization and outlines your plan to fix them. Think of it as your remediation roadmap. It lists what’s broken, what you’re going to do about it, who’s responsible, and when it will be completed.

The POA&M concept isn’t new to CMMC. It comes from the Federal Information Security Modernization Act (FISMA) and has been used in government cybersecurity programs for years. For defense contractors, the POA&M works alongside your System Security Plan (SSP) to provide a complete picture of your security posture.

Your SSP documents what you’ve implemented. Your POA&M documents what you haven’t—and how you plan to get there.

How POA&Ms Work Under CMMC

Here’s where things get important, and where CMMC differs from the previous self-attestation model under Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012.

Under the old system, contractors could have extensive POA&Ms and still claim compliance. You could acknowledge dozens of unmet requirements, promise to fix them eventually, and continue working on defense contracts. That era is ending.

CMMC introduces strict limitations on what can remain in a POA&M at the time of assessment. For CMMC Level 2, you cannot have POA&M items for every security requirement. Certain requirements must be fully implemented before you can achieve certification. The CMMC Program Final Rule specifies that you can only have a limited number of requirements on your POA&M—and those items must be closed out within 180 days of your conditional certification.

This means your POA&M strategy matters. You can’t simply document gaps and hope for the best. You need a realistic, executable plan that demonstrates your organization’s commitment to achieving full compliance.

POA&M Best Practices for CMMC Success

Start With an Honest Gap Assessment

Before you can build an effective POA&M, you need to know exactly where you stand. Conduct a thorough gap assessment against all 110 security requirements in National Institute of Standards and Technology (NIST) Special Publication 800-171. Be brutally honest with yourself.

Many organizations make the mistake of marking requirements as “implemented” when they’re only partially addressed. That approach backfires during assessment. If an assessor finds that a control you claimed to have implemented is actually incomplete, you’ve created a credibility problem that affects your entire evaluation.

Document every gap you find. Note partial implementations. Identify controls that exist in policy but aren’t enforced in practice. This honest baseline becomes the foundation for your POA&M.

Prioritize Strategically

Not all security gaps are created equal under CMMC. Some requirements can appear on your POA&M at assessment time, while others cannot. Understanding this distinction is essential for prioritization.

Focus your remediation efforts on requirements that must be fully implemented before assessment. These typically include fundamental security controls that protect the confidentiality of Controlled Unclassified Information (CUI). Requirements related to access control, identification and authentication, and system protection often fall into this category.

Beyond CMMC-specific prioritization, consider risk. Which gaps expose your organization to the greatest potential harm? Address high-risk vulnerabilities first, even if they’re technically allowed on your POA&M. Remember, the goal isn’t just certification—it’s actually protecting sensitive defense information.

Write Clear, Specific Entries

Every POA&M entry should answer these questions clearly:

What is the weakness? Describe the specific security gap in plain language. Reference the NIST SP 800-171 requirement number and explain exactly what aspect of the requirement isn’t being met. Vague descriptions like “need to improve access controls” don’t help anyone.

What is the remediation plan? Explain specifically what actions will be taken to address the weakness. Include enough detail that someone unfamiliar with your organization could understand the approach. If multiple steps are required, list them.

Who is responsible? Assign a specific individual or role to each POA&M item. Accountability matters. When no one owns a remediation task, it doesn’t get done.

What resources are required? Identify budget, personnel, technology, or other resources needed to complete the remediation. This demonstrates realistic planning and helps leadership understand the investment required.

When will it be completed? Set a realistic target completion date. Under CMMC, POA&M items must be closed within 180 days of conditional certification, so your timelines need to reflect that constraint.

Set Realistic Timelines

One of the most common POA&M mistakes is setting arbitrary or overly optimistic deadlines. Listing a completion date of “next month” for a complex infrastructure change doesn’t demonstrate good planning—it demonstrates that you haven’t thought through what’s actually required.

Consider the full scope of each remediation effort. Technology implementations require procurement, configuration, testing, and deployment. Policy changes require drafting, review, approval, and communication. Training programs require development, scheduling, and delivery. Build these realities into your timelines.

At the same time, don’t let timelines stretch indefinitely. POA&M items that linger for years signal organizational dysfunction. If a remediation truly requires eighteen months, break it into smaller milestones that show progress along the way.

Track Progress Actively

Your POA&M isn’t a document you create once and file away. It’s an active management tool that requires regular attention.

Establish a review cadence—monthly at minimum—where you assess progress on each open item. Are remediation activities on track? Have new obstacles emerged? Do timelines need adjustment? Regular reviews keep remediation efforts moving and surface problems before they derail your compliance timeline.

Document your progress within the POA&M itself. When you complete a milestone, note it. When you encounter delays, document the reason and your adjusted approach. This audit trail demonstrates active management and organizational commitment to compliance.

Connect POA&M Items to Evidence

As you close POA&M items, document the evidence that demonstrates completion. If you implemented a new technical control, capture configuration screenshots. If you deployed a new policy, retain the approved document and communication records. If you conducted training, keep attendance records and completion certificates.

This evidence serves multiple purposes. It verifies internally that remediation was actually completed, not just marked as done. It provides documentation for your CMMC assessment. And it creates a historical record that supports future compliance activities.

Avoid Common POA&M Pitfalls

Don’t use the POA&M as an excuse to delay action. Some organizations treat POA&M documentation as a substitute for actual remediation. They carefully document their gaps, set distant completion dates, and then do nothing. Under CMMC, this approach leads to failed assessments and lost contract opportunities.

Don’t create duplicate entries. If a single root cause affects multiple requirements, address it holistically rather than creating separate POA&M items for each affected requirement. This approach is more efficient and demonstrates that you understand the relationships between controls.

Don’t forget about inherited controls. If you use cloud services or managed security providers, some controls may be partially or fully implemented by those providers. Make sure your POA&M accurately reflects shared responsibilities and doesn’t claim gaps for controls that are actually addressed through your service agreements.

Don’t ignore the 180-day clock. Once you receive conditional CMMC certification, you have 180 days to close all POA&M items. If you enter assessment with POA&M items that realistically require a year to remediate, you’re setting yourself up for failure. Plan accordingly before you schedule your assessment.

Integrate POA&M Management Into Operations

The most successful organizations don’t treat POA&M management as a separate compliance activity. They integrate it into their regular operational rhythm.

Include POA&M status in leadership briefings. Make remediation progress part of IT and security team performance metrics. Allocate budget specifically for POA&M remediation activities. When compliance becomes part of how you operate rather than something you do on the side, progress happens naturally.

Consider assigning a dedicated compliance coordinator or team to manage POA&M activities. This person tracks progress, coordinates resources, removes obstacles, and ensures nothing falls through the cracks. For smaller organizations, this might be an additional responsibility for an existing role. For larger organizations, it might warrant dedicated staff.

POA&M Documentation Requirements

Your POA&M should include standard fields that enable effective tracking and reporting:

• Unique identifier for each item
• Date the weakness was identified
• Source of the finding (self-assessment, audit, incident, etc.)
• NIST SP 800-171 requirement reference
• Description of the weakness
• Remediation plan with specific actions
• Responsible individual or role
• Required resources
• Scheduled completion date
• Current status
• Milestones and progress notes
• Completion date and evidence reference (when closed)

Many organizations use spreadsheets to track POA&M items, which works fine for smaller programs. As your compliance program matures, consider dedicated governance, risk, and compliance (GRC) tools that provide better tracking, reporting, and integration capabilities.

Preparing for Assessment

Before your CMMC assessment, review your POA&M critically. Assessors will examine not just what’s on your POA&M, but how you’ve managed it.

Verify that all items have realistic, achievable completion dates within the 180-day window. Ensure documentation clearly explains each weakness and the remediation approach. Confirm that responsible parties are assigned and aware of their obligations. Check that closed items have appropriate evidence documented.

Be prepared to discuss your POA&M with assessors. They’ll want to understand your remediation approach, your progress tracking methodology, and your confidence in meeting completion targets. Organizations that demonstrate mature POA&M management practices make a positive impression that extends to the overall assessment.

The Bottom Line

Your Plan of Action and Milestones is more than a compliance checkbox. It’s a tool that demonstrates your organization’s security maturity and commitment to protecting defense information. A well-managed POA&M shows that you understand your gaps, have realistic plans to address them, and actively track progress toward full compliance.

Under CMMC, the stakes are higher than ever. The days of indefinite POA&M items and perpetual “planned” compliance are over. Organizations that master POA&M management will achieve certification and continue supporting the defense industrial base. Those that don’t will find themselves locked out of DoD contract opportunities.

Start now. Assess honestly. Plan realistically. Execute diligently. Your POA&M tells the story of your compliance journey—make sure it’s a story that ends with certification.

---

Need Help With Your CMMC Compliance Journey?

Navigating CMMC requirements can feel overwhelming, especially when you’re trying to run your business at the same time. At Greypike, a veteran-owned company, we understand the challenges defense contractors face because we’ve been in your shoes. Whether you have questions about building an effective POA&M, need guidance on prioritizing remediation efforts, or want hands-on support getting your organization assessment-ready, we’re here to help. Reach out to the Greypike team—we’d be happy to talk through your situation and point you in the right direction.

---

Sources

1. CMMC Program Final Rule – Department of Defense CMMC program requirements and assessment procedures
   https://www.ecfr.gov/current/title-32/subtitle-A/chapter-I/subchapter-A/part-170
2. NIST Special Publication 800-171 Revision 2 – Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations
   https://csrc.nist.gov/publications/detail/sp/800-171/rev-2/final
3. NIST Special Publication 800-171A – Assessing Security Requirements for Controlled Unclassified Information
   https://csrc.nist.gov/publications/detail/sp/800-171a/final
4. CMMC Model Overview – Cybersecurity Maturity Model Certification official documentation
   https://dodcio.defense.gov/CMMC/
5. DFARS Clause 252.204-7012 – Safeguarding Covered Defense Information and Cyber Incident Reporting
   https://www.acquisition.gov/dfars/252.204-7012-safeguarding-covered-defense-information-and-cyber-incident-reporting
6. OMB Circular A-130 – Managing Information as a Strategic Resource (POA&M requirements for federal systems)
   https://www.whitehouse.gov/wp-content/uploads/legacy_drupal_files/omb/circulars/A130/a130revised.pdf