How to Write a CMMC POA&M: Template, Requirements, and Common Mistakes

A Plan of Action and Milestones (POA&M, pronounced "po-am") is not a bureaucratic placeholder, it's the document that determines whether a C3PAO can issue a conditional CMMC certification or has to fail you outright. It's the difference between "conditionally certified" and "better luck next assessment window." Here's exactly what every row must contain, how your POA&M connects to your SPRS score, and the mistakes that get organizations failed.

CA.L2-3.12.2 CA.L2-3.12.4 NIST SP 800-171 Rev 2 DFARS 252.204-7012

What Is a POA&M and Why Is It Required?

A Plan of Action and Milestones (POA&M) is a structured document that identifies security gaps in your environment, describes the specific actions your organization will take to close those gaps, assigns responsibility, and sets target completion dates. It is the formal record of your remediation roadmap.

The POA&M requirement is embedded directly in NIST SP 800-171 Rev 2. Practice 3.12.2, which maps to CMMC practice CA.L2-3.12.2, requires organizations to "develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems." This is not optional guidance. It's a security practice with a point value, and failing to maintain a current POA&M is itself a finding.

The POA&M serves a second critical function: it's how a C3PAO determines whether your organization qualifies for a conditional CMMC certification. Under 32 CFR Part 170, a C3PAO can issue a conditional Level 2 certification when open findings meet specific criteria, no more than 20% of practices unimplemented (roughly 22 practices), no critical practices (MFA, encryption) on the POA&M, and all items with credible plans to close within 180 days. Without a POA&M, conditional certification isn't possible, because there's no documented plan to assess.

The 8 Required Fields in Every POA&M Row

A POA&M isn't a free-form document. Each row must capture specific data that enables an assessor (and your own management) to understand the gap, the plan, and the timeline. Here are the eight fields every row must contain:

1. Practice ID, The NIST 800-171 or CMMC practice number (e.g., AC.L2-3.1.3, IA.L2-3.5.3). This anchors the gap to a specific requirement and maps it to your SSP.
2. Practice Description, A brief, plain-language statement of what the practice requires. Don't just copy the NIST language verbatim, assessors want to see that your team understands the requirement.
3. Gap / Weakness, A specific, technical description of the current deficiency. "MFA not implemented" is not enough. "Microsoft 365 accounts lack MFA enforcement via Conditional Access; all accounts use password-only authentication" is what assessors need to see.
4. Remediation Actions, The specific steps your organization will take to close the gap. Each action should be concrete and testable. "Implement MFA" is vague. "Enable Azure AD Conditional Access policy requiring MFA for all users; enforce for all apps including legacy authentication block; test with 5 pilot users before rollout" is actionable.
5. Resources Required, What it will take to complete the remediation: budget, personnel, licenses, vendor support. This signals to assessors that the plan is resourced, not aspirational.
6. Responsible Party, The specific person (by name and title) who owns the remediation, not just "IT." Vague ownership means no accountability, and assessors know it.
7. Scheduled Completion Date, The target date by which the practice will be fully implemented. For conditional CMMC certification, all dates must fall within 180 days of the assessment. Dates more than 12 months out signal that the plan isn't real.
8. Milestones, Interim progress checkpoints between now and the completion date. A practice with a 6-month remediation timeline should have monthly or quarterly milestones that a C3PAO or DCSA auditor can check during follow-up reviews.

SPRS Score Impact of Open POA&M Items

Your SPRS score is calculated starting from a perfect 110 and subtracting points for every NIST 800-171 practice that is not fully implemented. Every item on your POA&M, because it represents a practice that is not yet implemented, reduces your SPRS score by that practice's assigned point value.

The DoD Assessment Methodology assigns different weights to different practices based on their security criticality. Some practices carry a 1-point deduction; others carry 5 points. An organization with 20 open POA&M items spread across high-weight practices could have a score well below zero.

The critical implication: your POA&M and your SPRS score must tell the same story. If your SPRS submission shows a score of 85 but your POA&M lists 10 open practices worth 30+ combined points, that's a false self-attestation, with False Claims Act exposure attached. A C3PAO will spot the discrepancy before you finish explaining it.

Highest Point-Value NIST 800-171 Practices

Prioritize your remediation roadmap around the practices that carry the highest point deductions. Closing a 5-point practice has 5x the SPRS impact of closing a 1-point practice. Here are five of the highest-weighted practices you should close first:

Practice ID	Domain	Description	Point Value
3.1.1 (AC)	Access Control	Limit system access to authorized users and processes	5 pts
3.4.1 (CM)	Config Management	Establish and maintain baseline configurations	5 pts
3.4.2 (CM)	Config Management	Establish settings and restrictions for constituent components	5 pts
3.5.3 (IA)	Identification & Auth	Use multi-factor authentication for local and network access	5 pts
3.13.8 (SC)	System & Comms	Implement cryptographic mechanisms to prevent unauthorized disclosure of CUI in transit	5 pts

Note that practices 3.5.3 (MFA) and 3.13.8 (encryption in transit) are also practices that cannot be on a POA&M for conditional CMMC certification, they must be fully implemented before a C3PAO assessment. This makes them doubly urgent to close.

What C3PAOs Actually Look For

Assessors who have reviewed dozens of POA&Ms across the DIB know within minutes whether a POA&M was built to satisfy a checkbox or built to actually guide remediation. Here's what distinguishes a POA&M that passes from one that gets you failed:

What passes

• Specific, technical gap descriptions that match actual environment findings
• Remediation actions broken into discrete, testable steps
• Named responsible parties with realistic ownership
• Target dates that are ambitious but credible, not "Dec 31" for every item
• Evidence artifacts cited (screenshots, tickets, vendor quotes) showing work has started
• Milestones that have already been completed on items in progress
• Cross-references to the SSP showing which practices are mapped

What fails

• POA&M items with no gap description, just a practice ID and a date
• Remediation actions that say "implement policy" with no technical specifics
• All target dates 12+ months out with no completed milestones
• MFA or encryption listed as planned, these must be done before assessment
• More than 20% of practices on the POA&M (blocks conditional certification)
• POA&M that contradicts the SPRS score submitted to the government

POA&M vs. SSP: How They Work Together

The System Security Plan (SSP) and the POA&M are companion documents, not alternatives. Your SSP documents the current implementation status of all 110 practices. For each practice, your SSP should indicate one of three statuses: Implemented, Planned, or Alternative Implementation.

Every practice marked Planned in your SSP must have a corresponding row in your POA&M. If your SSP says a practice is planned but your POA&M has no entry for it, that's an inconsistency a C3PAO will flag immediately. The two documents must tell the same story about your security posture.

Conversely, if your POA&M has an entry for a practice that your SSP marks as Implemented, that's also a red flag, it suggests either your SSP is wrong or your POA&M is a leftover that wasn't cleaned up when the practice was closed. Assessors will test both.

Common Mistakes That Get POA&Ms Rejected

1. Vague remediation actions

The most common POA&M failure is writing remediation actions that describe outcomes instead of steps. "Implement MFA" doesn't tell an assessor how you'll do it, who will do it, what systems are in scope, or how you'll verify it's working. Write your remediation actions as if you're handing them to a technician with no prior knowledge of your environment, because that's essentially what a C3PAO assessor is.

2. No target dates on individual milestones

A POA&M with a final completion date but no interim milestones is a plan without checkpoints. Assessors conducting follow-up reviews need to verify progress, and without milestones, there's nothing to verify. Break every remediation action into at least two or three milestones: planning, implementation, testing, and verification are natural checkpoints for most technical controls.

3. Not updating the POA&M after milestones are completed

A POA&M dated six months ago with no updates is evidence of a compliance theater exercise. It doesn't prove a working remediation process, it proves you filled one out once. The document should show the date each milestone was completed, who verified it, and any notes on what changed from the original plan. If your team completed a milestone on March 15, that date should be in the document. If the milestone slipped, the new date and reason should be documented.

4. Listing practices that don't actually have gaps

Some organizations, out of excessive caution, put every practice on the POA&M even if they're partially implemented. This inflates the apparent deficiency count and may push you above the 20% threshold for conditional certification. Only practices that are genuinely not yet implemented belong on the POA&M. Partially-implemented practices need accurate SSP implementation statements describing what's done and what remains.

5. Failing to sync with SPRS

The SPRS score you submitted must match the implementation status implied by your POA&M. If your score implies you've implemented 95 of 110 practices, but your POA&M lists 25 open items, you have a math problem, and potentially a False Claims Act problem. Assessors are very good at math. Reconcile these numbers before any assessment, not during it.

Frequently Asked Questions