StealthTech
The POA&M is the document in a CMMC compliance program that most clearly reveals whether an organization is managing its compliance posture or just documenting it. A well-constructed POA&M shows assessors that the organization knows where its gaps are, has thought seriously about how to address them, has assigned accountability for that work, and is actively tracking progress. A poorly constructed POA&M — or one assembled in the days before an assessment — shows assessors something different: that compliance documentation is being produced to satisfy a requirement rather than to manage a program.
The stakes of that distinction are real. In a CMMC Level 2 assessment, the POA&M is evaluated both as a document and as evidence of program maturity. Assessors who see a POA&M with a history — items opened when gaps were discovered, updated as remediation progressed, closed with evidence when work was complete — reach different conclusions about the organization’s compliance program than assessors who see a POA&M created last week with uniform target dates and no operational history.
This guide covers what a compliant CMMC POA&M requires, what each element needs to contain to satisfy assessor standards, how to document interim mitigations that demonstrate active risk management, and how to build and maintain a POA&M that functions as a genuine compliance management tool rather than a pre-assessment deliverable.
What the POA&M Is Required to Do
The Plan of Action and Milestones serves two functions in a CMMC compliance program, and understanding both is essential for building one that satisfies assessors in both dimensions.
The first function is internal management. The POA&M is the mechanism by which an organization tracks known compliance gaps, assigns remediation responsibility, establishes timelines, documents interim risk management measures, and monitors progress toward full compliance. In this role, the POA&M is a project management tool that keeps remediation work moving and makes compliance status visible to leadership without requiring a full program review.
The second function is external transparency. In the CMMC assessment context, the POA&M communicates to assessors — and ultimately to the DoD — what the organization knows about its own compliance gaps and what it’s committed to doing about them. This transparency function is the basis for the conditional certification pathway: organizations that have POA&M-eligible findings can receive conditional certification precisely because the POA&M represents a binding commitment to address those gaps within a specified timeframe.
These two functions reinforce each other when the POA&M is built as a genuine management tool. An organization that uses its POA&M to actually manage remediation work naturally produces a document that communicates credibly to assessors — because the history it contains reflects real program activity rather than pre-assessment construction. An organization that builds its POA&M as a compliance deliverable rather than a management tool produces a document that may satisfy format requirements while failing the credibility test that experienced assessors apply.
The DoD’s CMMC program documentation provides authoritative guidance on POA&M requirements within the CMMC framework, and the NIST SP 800-18 guidance on system security plan development provides additional context for how POA&Ms are expected to function within a broader compliance program structure.
The Elements of a Compliant CMMC POA&M
A POA&M that satisfies CMMC assessors contains specific elements for each documented gap. Missing any of these elements creates questions that the POA&M should have pre-empted, and an assessor who has to ask basic questions about a POA&M item is an assessor who is investigating rather than verifying.
The specific practice and its current implementation status. Each POA&M item should identify the CMMC Level 2 practice by its practice number and name — for example, “3.5.3: Employ multifactor authentication for local and network access to privileged accounts and for network access to non-privileged accounts” — and describe precisely what aspect of that practice is not fully implemented. The description needs to be specific enough that someone unfamiliar with the organization can understand exactly what the gap is without additional explanation. “MFA not implemented” is insufficient. “Conditional Access Policy CA-003 does not enforce MFA for service accounts in the DevOps-SVC and Monitoring-SVC security groups, representing 12 accounts with access to the CUI SharePoint environment” is the level of specificity that demonstrates genuine understanding of the gap.
The root cause of the gap. Assessors who see a root cause analysis in a POA&M understand that the organization has thought carefully enough about the gap to understand why it exists, not just that it exists. Root causes typically fall into several categories: technical — the infrastructure or tooling to implement the control doesn’t exist or wasn’t configured correctly; process — the process that should produce the control outcome isn’t functioning as designed; or resource — the personnel or budget to implement the control hasn’t been allocated. Identifying the root cause directly influences the remediation approach and the timeline, because a gap that exists because of a missing technology has a different path to resolution than one that exists because of a process failure or a resource constraint.
The interim mitigation measures. This is the element most frequently missing from POA&Ms that were assembled for assessment purposes rather than built as management tools. Interim mitigations are the specific actions the organization has taken to reduce risk while the gap exists — the compensating controls or risk management measures that demonstrate the organization isn’t simply operating with an unmanaged gap during the remediation period. For a service account MFA gap, an interim mitigation might be enhanced logging and alerting on those accounts, a restriction of their network access paths to the minimum required, and a documented risk acceptance at the CISO or equivalent level. For a vulnerability remediation gap, an interim mitigation might be network isolation of the affected systems combined with enhanced monitoring of traffic to and from those systems.
Interim mitigations are evaluated by assessors as evidence of proactive risk management. An organization that identifies a gap and documents what it’s doing about the risk in the interim — before the full remediation is complete — demonstrates a fundamentally different approach to compliance than one that identifies a gap and notes only when it will be fixed. The interim mitigation also matters for conditional certification: it’s part of what makes a POA&M-eligible finding eligible for conditional treatment rather than immediate disqualification.
The specific owner. Each POA&M item needs a named individual — not a role, not a department, not “IT” — who is personally accountable for ensuring the remediation is executed on schedule. The named owner is who an assessor will direct follow-up questions to during a follow-on assessment, and they need to be able to speak specifically about the gap, the remediation work performed, and the evidence of completion. An owner who learns about the POA&M item during the assessment preparation briefing is not the same as an owner who has been managing the remediation for months — and assessors can tell the difference in interviews.
Milestones with specific dates. The remediation path from current state to fully implemented should be broken into discrete milestones, each with a target date. The milestones should represent meaningful intermediate steps — completing a technology procurement, deploying a configuration change, completing a policy revision, executing an initial run of a new process — rather than arbitrary date checkpoints. Milestones that progress logically from gap identification through root cause analysis, through solution design, through implementation, through testing, and through documentation update tell the story of deliberate, managed remediation. Milestones that consist of “work in progress” with a single completion date don’t.
Target dates need to be realistic. This is one of the more common POA&M credibility failures: target dates that appear optimistic given the complexity of the gap, or that cluster uniformly around the assessment date regardless of the nature of different items. An assessor who sees 15 POA&M items all with the same target date — particularly when that date coincides with the assessment window — draws obvious conclusions. Dates that reflect the actual effort required for each specific gap, with variation across items that reflects different remediation complexities, are more credible because they appear to be based on genuine planning rather than compliance optics.
Evidence of completion. When a POA&M item is remediated, the closure documentation should reference the specific evidence that demonstrates completion — the configuration export showing the control is now implemented, the process record showing the first execution of the new procedure, the training record showing the personnel impacted by the change were notified and trained. Closing a POA&M item with a note that remediation is complete but without a reference to verifiable evidence isn’t closure that satisfies assessors — it’s a statement that needs to be verified before the item can be scored as Met.
POA&M-Eligible vs. Non-Eligible Findings: Understanding the Boundary
Not every CMMC Level 2 gap can be addressed through a POA&M for conditional certification purposes. The DoD has established that certain practices carry such fundamental weight in protecting CUI that a Not Met determination on them cannot be accommodated through conditional treatment — they must be fully implemented at the time of assessment for any certification to be granted.
Understanding this boundary before the assessment — and ensuring that practices in the non-eligible category are fully implemented before the C3PAO arrives — is critical compliance program management. Building a POA&M that includes practices from the non-eligible category signals either a misunderstanding of the framework or a decision to proceed with known disqualifying gaps, neither of which produces a positive assessor impression.
The practices most clearly identified as carrying immediate disqualifier status are concentrated in the foundational security domains — access control enforcement, multi-factor authentication, and basic audit capabilities that form the security foundation on which other controls depend. The definitive guidance on which specific practices are non-eligible for POA&M treatment is maintained in the DoD’s CMMC program documentation and updated as the program matures, and organizations preparing for assessment should verify the current list rather than relying on descriptions that may predate policy updates.
For practices that are POA&M-eligible, the aggregate number of open items also affects certification outcome. The DoD has established limits on how many POA&M-eligible findings can be open simultaneously while still qualifying for conditional certification. An organization approaching those limits needs to understand how close they are and either accelerate remediation of lower-priority items or develop a specific strategy for managing the POA&M within the conditional certification threshold.
What Makes a POA&M Signal Program Maturity
Assessors who review POA&Ms regularly develop a pattern recognition for the difference between documents that reflect genuine compliance program management and documents assembled to satisfy assessment requirements. The signals that communicate maturity — and the signals that communicate the opposite — are worth understanding explicitly.
The history of the document is the most revealing signal. A POA&M that shows items opened at various points over the past year — some now closed with evidence, some still in progress at various stages of their remediation milestones, some recently opened from an internal audit — tells the story of a compliance program that monitors itself continuously and manages gaps as they’re discovered. A POA&M where every item was opened within the last 30 to 60 days, with no closed items and uniform target dates, tells a different story regardless of what the items say.
The specificity of the item descriptions is the second signal. Items described with precise gap identification, specific root causes, and concrete intermediate milestones reflect a level of analytical engagement with the gap that casual documentation doesn’t produce. Items described in generic terms — “implement logging” without specifying which systems, what events, and what the current logging state is — reflect documentation of requirements rather than documentation of specific organizational gaps.
The credibility of the interim mitigations is the third signal. Interim mitigations that are proportionate to the risk of the gap and technically plausible given the organization’s environment signal that the mitigations were designed by someone who understands both the gap and the environment. Interim mitigations that are generic — “increased monitoring” without specifying what monitoring capability exists or how it’s been applied to the affected systems — signal mitigations that were added to satisfy the POA&M format requirement rather than to actually manage risk.
The organizational engagement visible in the ownership and milestone structure is the fourth signal. POA&Ms where ownership is distributed across multiple specific individuals, where milestones reflect the different resource constraints and technical complexities of different items, and where the remediation approach for each item reflects the specific root cause of that item show an organization that has genuinely engaged with its compliance gaps at an operational level. POA&Ms where everything is owned by “IT Director” and where all items have identical milestone structures show an organization that produced a document.
Building the POA&M Into the Compliance Program Workflow
The POA&M that satisfies assessors is one that has been functioning as a live management tool throughout the compliance program — not one that gets built in preparation for the assessment. Building it into the compliance program workflow from the beginning produces the history and operational substance that distinguish mature POA&Ms from pre-assessment artifacts.
The trigger for a new POA&M item should be any compliance gap identified through any channel: the initial gap assessment, an internal audit, a readiness assessment finding, a vulnerability scan result that surfaces an applicable gap, a vendor relationship review that identifies a control deficiency, or a configuration change that inadvertently created a gap. Each of these channels produces POA&M items if connected to the program correctly — and the variety of sources that populate a mature POA&M is itself a signal of a program that has multiple mechanisms for identifying and managing gaps.
Internal audit activities are the primary ongoing source of POA&M items for organizations that conduct them on a defined schedule. A quarterly internal audit that evaluates each control domain against current implementation produces new items when drift is discovered and closes existing items when remediation is verified. Over the course of a year, this cycle produces a POA&M with the operational history that assessors look for — and it ensures that no gap persists unmanaged between discovery and resolution. Our guide on building a continuous compliance program covers how internal audit processes integrate with POA&M management.
The POA&M review cadence matters as much as the audit cadence. A POA&M that gets opened and closed but never reviewed between those events isn’t functioning as a management tool. Monthly POA&M reviews — where owners report on milestone progress, where overdue items are escalated, where interim mitigations are confirmed still in place, and where new items from the month’s operations are added — keep the document current and keep leadership visibility into compliance posture real rather than nominal.
Integrating the POA&M With the System Security Plan
The POA&M and the SSP function as a paired set of documents in CMMC compliance — the SSP describes what is implemented, and the POA&M documents what isn’t yet and what the plan is to address it. Assessors evaluate them together, and inconsistencies between what the SSP describes and what the POA&M documents create questions that neither document answers clearly on its own.
An SSP that describes a control as fully implemented should have no corresponding POA&M item. An SSP control description that acknowledges partial implementation should have a corresponding POA&M item that documents the gap, the interim mitigation, and the remediation path. SSP descriptions that describe implemented controls for which POA&M items also exist signal that one of the two documents is inaccurate — either the SSP is overstating implementation, or the POA&M is documenting a gap that has actually been closed.
Maintaining consistency between the SSP and POA&M requires updating both documents when either control status or gap status changes. When a POA&M item is closed, the SSP control description for the corresponding practice should be updated to reflect the fully implemented status — with the specific implementation details that reflect what the remediation produced. When a new gap is discovered and a new POA&M item is opened, the SSP control description should be updated to acknowledge the gap and reference the POA&M item rather than continuing to describe the control as fully implemented.
This integration discipline is one of the compliance program practices that most clearly distinguishes organizations with mature documentation management from those without it. Our detailed guide on creating a System Security Plan covers the SSP documentation standards that apply to both fully implemented controls and controls with associated POA&M items.
Managing POA&M Closure: What Evidence Is Required
Closing a POA&M item is not a unilateral decision by the control owner. It requires evidence that the gap has been remediated to the standard that would satisfy an assessor evaluating the practice fresh — because in a follow-on assessment or triennial reassessment, that is exactly the evaluation the closed item will face.
The evidence required to close a POA&M item depends on the type of control gap the item documented. For technical control gaps, closure evidence is the technical artifact that demonstrates the control is now deployed and configured correctly: a configuration export from the identity provider showing MFA is now enforced for the previously excluded accounts, a vulnerability scan showing the previously open findings are now remediated, a firewall rule set showing boundary protection controls are now in place. The artifact needs to be specific to the gap the item documented — not a general system report that includes the relevant information somewhere within it.
For process control gaps, closure evidence is the record of the process being executed under the new or revised design: a log review record produced under the new review schedule, an access review record reflecting the updated review procedure, a change management record showing the first change processed under the new change control process. Process evidence is particularly important to accumulate before the follow-on assessment rather than producing a single execution at the time of closure, because a single execution doesn’t demonstrate that the process is operational rather than one-time.
For documentation gaps — where the gap was that controls existed but weren’t documented to assessor standards — closure evidence is the updated documentation itself along with confirmation that the documentation accurately reflects the operational state of the control. An SSP control description updated after a documentation gap finding should be reviewed by someone other than the author to confirm it describes the operational reality before the POA&M item is closed.
The POA&M Under Conditional Certification: Managing the Remediation Clock
When a formal C3PAO assessment results in conditional certification with open POA&M items, those items are no longer just internal management tools — they’re commitments to the DoD with a binding remediation deadline. The conditional certification POA&M management context is more demanding than the ongoing program management context in specific ways.
The remediation deadline — typically 180 days from the assessment date — is firm. It doesn’t extend because remediation took longer than anticipated, because resources were diverted to operational priorities, or because the follow-on assessment couldn’t be scheduled in time. Building the remediation timeline for conditional POA&M items with appropriate buffer before the deadline, rather than planning remediation to complete exactly at the deadline, protects against the scenarios that consistently cause organizations to miss their conditional certification windows.
Communication with the C3PAO during the conditional certification remediation period matters more than most organizations realize. C3PAOs who are kept informed of remediation progress — through periodic status updates or milestone completion notifications — can schedule the follow-on assessment more efficiently and may be able to provide informal guidance on whether the remediation approach being pursued will satisfy the follow-on assessment. C3PAOs who learn the remediation status only when asked to schedule the follow-on assessment are working from less information at a more compressed timeline.
The follow-on assessment that closes conditional certification evaluates the specific practices that were Not Met in the initial assessment. A well-managed conditional certification POA&M produces a follow-on assessment that is focused and efficient — the assessor verifies specific remediations against specific evidence, and the result is a straightforward transition from conditional to full certification. A poorly managed conditional certification period — where remediation was rushed in the final weeks before the follow-on, evidence is thin, and the SSP doesn’t reflect the remediated state — produces a follow-on assessment that looks more like a second initial assessment.
For organizations navigating the compliance program overall — including the POA&M as one element of a complete documentation and operational posture — a compliance partner with specific CMMC experience can provide the program management support that keeps conditional certification timelines on track and ensures the follow-on assessment arrives with the evidence it needs. A vCIO who has managed conditional certification programs through to full certification brings the institutional experience that makes the difference between an efficient closure and a drawn-out process.
Common POA&M Mistakes and How to Avoid Them
Understanding the specific mistakes that appear most frequently in CMMC POA&Ms helps organizations avoid building those mistakes into their own documents.
Creating the POA&M as a pre-assessment activity rather than a program management tool is the foundational mistake from which most others follow. The POA&M’s purpose is to manage compliance gaps throughout the program lifecycle, not to document them for assessment purposes. Organizations that don’t build and maintain a POA&M until assessment preparation begins produce documents that look exactly like what they are — and the history they lack is visible to assessors who have seen what mature POA&Ms look like.
Using role-level ownership rather than named individuals means there’s no personal accountability for remediation — and no specific person for an assessor to interview about a POA&M item’s status. Every item needs a named owner who will be personally accountable for milestone progress.
Documenting interim mitigations that don’t correspond to real risk management activity undermines the credibility of the entire POA&M. If the interim mitigation says “enhanced monitoring,” the monitoring infrastructure that supports that claim needs to exist. If it says “network isolation,” the network controls implementing that isolation need to be technically verifiable. Mitigations that can’t be verified technically are claims the POA&M makes that assessors will investigate.
Leaving items open after remediation is complete rather than closing them with evidence creates a POA&M that understates the organization’s actual compliance posture. Assessors who see items that appear to be remediated based on interview discussion but aren’t closed in the POA&M ask why — and the answer is usually that the organization either doesn’t trust that the remediation is complete or hasn’t built the closure process into their compliance management workflow.
Conclusion: The POA&M Is a Mirror of Your Compliance Program
The Plan of Action and Milestones reflects how the organization manages its compliance program more honestly than almost any other compliance document — because it can’t be fabricated convincingly. A POA&M with genuine history, specific gap documentation, credible interim mitigations, named owners, realistic milestones, and properly closed items with evidence is a document that was produced by an organization managing compliance actively. A POA&M that lacks those characteristics is a document produced for an assessment.
Assessors know the difference. Building the POA&M as the management tool it’s designed to be — from the beginning of the compliance program, maintained through every internal audit and operational change that affects compliance status — produces a document that serves both its management function and its transparency function without requiring any specific effort to make it look credible. The credibility comes from the program it reflects.
If your organization is planning its CMMC compliance journey, contact Stealth Technology Group today at (617) 903-5559 to learn how modern cybersecurity infrastructure can accelerate your path toward certification readiness.
