A POA&M (plan of action and milestones, often written POAM) is a document that lists every security requirement you have not fully met yet and, for each one, says what you will do about it, who is responsible, and by what date. That is the whole idea. It is the honest half of a compliance program: the System Security Plan says what you do, and the POA&M says what you do not do yet and when that changes.
If you handle federal data, you will be asked for one. This post covers what a POA&M has to contain, walks through a worked example, and explains the limits that NIST SP 800-171 and CMMC put on what you are allowed to leave open.
What does POA&M (POAM) stand for?
Plan of Action and Milestones. You will see it written POA&M, POAM, and sometimes POA+M; they are the same thing, and most people say it "poh-am." The term comes from federal information security practice, where agencies have used it since the early 2000s to track known weaknesses in their systems. Contractors inherited it along with the requirements.
What goes in a POA&M?
There is no single mandated format for contractors, but every usable POA&M answers the same questions for each open item:
- The weakness. What is not in place, stated specifically enough that someone else could verify it.
- The requirement it maps to. The control number, such as NIST SP 800-171 requirement 3.5.3.
- How it was found. A self-assessment, a scan, an audit, an incident.
- The planned fix. What will actually be done, not "implement the control."
- Resources. People, hours, budget, tools.
- Milestones with dates. The intermediate steps, each with its own date.
- A scheduled completion date. One date for the whole item.
- An owner. A named person, not a department.
- Status. Open, in progress, delayed (with the reason), or closed.
- Evidence at closure. What will prove it is done.
A POA&M example
Here is one entry, written the way we would want to read it:
| Field | Entry |
|---|---|
| Weakness | Multifactor authentication is enforced for administrators and for remote access, but not for 14 standard user accounts that can open CUI. |
| Requirement | NIST SP 800-171 3.5.3 (CMMC IA.L2-3.5.3) |
| Found by | Annual self-assessment, October 6, 2026 |
| Planned fix | Extend the conditional access policy to all users; block legacy authentication protocols. |
| Resources | IT lead, about 12 hours. No new licensing. |
| Milestones | Oct 20: pilot group of five users. Nov 3: all users. Nov 10: legacy authentication blocked. |
| Scheduled completion | November 10, 2026 |
| Owner | The IT lead, by name |
| Status | In progress. Pilot completed October 20. |
| Evidence at closure | Policy export, plus a sign-in log sample showing MFA on every account. |
Notice what makes it useful. The weakness is countable, the fix is concrete, the dates are real, and a stranger could check the evidence. Compare it with the entry we see far more often: "3.5.3 not fully implemented. Remediation in progress. Target: Q4." That entry tells an assessor nothing, and six months later it tells you nothing either.
POA&M vs. SSP: what is the difference?
The System Security Plan (SSP) describes your environment and how each requirement is met. The POA&M lists the requirements that are not met yet. They are a pair. NIST SP 800-171 asks for both (requirement 3.12.4 for the SSP, 3.12.2 for plans of action), and each open POA&M item should point at the part of the SSP it will complete. A POA&M without an SSP is a to-do list with no map. An SSP that claims everything is done, with no POA&M beside it, is usually a claim nobody has tested.
Who requires a POA&M?
- NIST SP 800-171, requirement 3.12.2: "Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems." If your contracts carry DFARS 252.204-7012, this applies to you.
- NIST SP 800-53, control CA-5, for federal systems and the contractors that operate them.
- FedRAMP, where cloud providers maintain a POA&M as part of continuous monitoring.
- CMMC, which permits a POA&M at Level 2 under strict conditions and not at all at Level 1.
What CMMC allows on a POA&M, and what it does not
The CMMC rule (32 CFR 170.21) is specific. At Level 2, an open POA&M is only compatible with a conditional status, and only when all of the following are true:
- Your assessment score is at least 80 percent of the total, which is 88 of 110 points.
- Nothing on the POA&M is worth more than 1 point in the scoring methodology. The one exception is CUI encryption (SC.L2-3.13.11), which may be on the list when encryption is in use but is not FIPS-validated.
- Six requirements can never be on it: AC.L2-3.1.20 (external connections), AC.L2-3.1.22 (publicly posted information), CA.L2-3.12.4 (the SSP itself), and the three physical protection requirements PE.L2-3.10.3, 3.10.4 and 3.10.5 (escorting visitors, physical access logs, and managing physical access).
- Everything on it is closed, and confirmed by a closeout assessment, within 180 days. If it is not, the conditional status expires.
At Level 1 a POA&M is not permitted at all. You either meet every requirement or you do not.
So the MFA example above is a perfectly good POA&M entry for your own program, but because requirement 3.5.3 is worth more than one point, it could not be carried into a conditional CMMC status. That distinction matters: your working POA&M should list everything that is open. The CMMC rule only limits which of those items may still be open when you claim a status.
A note on timing. The third-party certification phase of CMMC is suspended while the Department of War reviews the program, and we keep a running status page on that. Self-assessment and NIST SP 800-171 were not suspended, and those are where the POA&M lives.
Your POA&M and your SPRS score
If you have submitted a NIST SP 800-171 self-assessment score to SPRS, the POA&M is the other side of that number. Scoring starts at 110 and subtracts 1, 3 or 5 points for each requirement that is not implemented. When the score is below 110, you also report the date you expect to reach 110, and that date is supposed to come from your plan of action.
A score of 96 next to a POA&M with three open items does not add up, and that mismatch is the first thing an assessor, a prime, or an investigator will find. The score is a representation to the government. The POA&M is how you show it was made in good faith.
Five POA&M mistakes we see from the assessor's side
- Dates that slide. An item whose completion date has moved four times is not a plan. Record the original date, the new date, and why.
- No owner. "IT" is not an owner. A name is.
- One line per control family. "Access Control: in progress" hides 22 separate requirements.
- Closing items without evidence. "Done" needs something a third party can look at.
- Treating it as an annual document. Environments change weekly. A POA&M reviewed once a year describes a system that no longer exists.
A POA&M template to start from
You do not need software to begin. A spreadsheet with the ten fields above as columns, and one row per open item, is a legitimate POA&M template. NIST publishes a plain plan-of-action template alongside SP 800-171, and FedRAMP publishes a more detailed one for cloud systems. Either works. The format matters much less than whether each row can be verified and whether the dates are being kept.
Keeping it true
The hard part of a POA&M is not writing it. It is keeping it accurate after the week it was written, once the person who owned an item has changed roles and the configuration has drifted. That is the problem OCIC is built around: verify the real configuration continuously and keep the evidence current, so the plan and the environment stay in step.
If you want a second set of eyes on your SSP and POA&M before someone else reads them, that is what our CMMC and compliance readiness work is for. We have sat on the assessor's side of the table, so we can tell you what holds up and what does not.
Sources: 32 CFR 170.21, Plans of Action and Milestones; NIST SP 800-171 Rev. 2; DFARS 252.204-7019.
