CMMC POA&Ms: What You Can Put on One, and the 180-Day Closeout
Level 1 allows no POA&Ms. Level 2 allows them only for a few low-value requirements, only with a score of 88 or more, and only for 180 days. The rules from 32 CFR 170.21, and how to plan a POA&M you can actually close.
Under CMMC, a Plan of Action and Milestones (POA&M) lets an organization pass a Level 2 assessment with a few requirements still open, as long as it closes them fast. It's a narrow allowance, not a safety net. Level 1 allows none at all, Level 2 allows them only for a short list of low-value requirements, and every one of them has to be closed and confirmed within 180 days, or the status expires.
- Level 1: no POA&Ms, ever. All 15 requirements must be met.
- Level 2: a POA&M is allowed only if you score at least 88 of 110, every open item is worth 1 point (with one encryption exception), and none of six specific requirements is open.
- The clock: close every item and pass a closeout assessment within 180 days of your Conditional status date, then affirm again.
- Miss it: the Conditional status expires, and you can't win new awards at that level until you earn a new status.
What is a CMMC POA&M?
The CMMC rule defines a POA&M simply as "a document that identifies tasks needing to be accomplished" (32 CFR § 170.4). In practice it lists each requirement scored NOT MET in an assessment, what will fix it, who owns the fix, and when it will be done.
Two things it isn't:
- It isn't credit. The scoring rule is blunt: a POA&M "is not a substitute for a completed requirement," and anything not implemented is scored NOT MET, POA&M or not (32 CFR § 170.24).
- It isn't the same as the plans of action NIST SP 800-171 has always asked for. Your system security plan and plans of action can track any gap. A CMMC POA&M is the much smaller set of gaps the rule lets you carry into a Conditional status.
Who can use a POA&M?
Not Level 1. "A POA&M is not permitted at any time for Level 1 self-assessments" (32 CFR § 170.21). Every one of the 15 Level 1 requirements has to be met before you submit and affirm.
Level 2, with conditions. A Level 2 self-assessment or C3PAO assessment can end in a Conditional status with open items, but only if all three of these are true:
“(i) The assessment score divided by the total number of CMMC Level 2 security requirements is greater than or equal to 0.8; (ii) None of the security requirements included in the POA&M have a point value of greater than 1 …, except SC.L2-3.13.11 CUI Encryption may be included on a POA&M if encryption is employed but it is not FIPS-validated, which would result in a point value of 3; and (iii) None of the following security requirements are included in the POA&M”
- 10.8 of 110A score of at least 88. Below that, there’s no Conditional status at all.
- 21-point items onlyRequirements worth 3 or 5 points have to be met at assessment time.
- 3One exceptionEncryption that’s in place but not FIPS-validated. No encryption at all is 5 points, and can’t go on a POA&M.
- 4Six neverThe requirements listed below can never be on a POA&M, whatever they’re worth.
- AC.L2-3.1.20 External Connections (CUI Data)
- AC.L2-3.1.22 Control Public Information (CUI Data)
- CA.L2-3.12.4 System Security Plan
- PE.L2-3.10.3 Escort Visitors (CUI Data)
- PE.L2-3.10.4 Physical Access Logs (CUI Data)
- PE.L2-3.10.5 Manage Physical Access (CUI Data)
The point values come from the CMMC scoring method in 32 CFR § 170.24. Requirements that could lead to significant exploitation of the network or exfiltration of CUI are worth 5 points; those with a "specific and confined effect" are worth 3; the rest are worth 1. So the practical rule is simple: anything high-impact has to be done before the assessment. A POA&M only covers the small stuff.
A POA&M doesn't lower the bar. It gives you 180 days to finish clearing it.
How does the 180-day closeout work?
The clock starts on your Conditional CMMC Status Date, the day results post. From there, every open item has to be fixed and confirmed by a closeout assessment that "assesses only the NOT MET requirements that were identified with POA&M," and it has to happen "within 180-days of the Conditional CMMC Status Date" (§ 170.21(b)). The rule has no extension.
Here's what the 180 days look like, closed in time and missed:
THE 180-DAY WINDOW · CLOSED VS. MISSEDWho runs the closeout depends on how you were assessed:
- Level 2 (Self): your organization performs it, the same way as the original self-assessment, and posts the results in SPRS.
- Level 2 (C3PAO): an authorized or accredited C3PAO performs it and posts the results in eMASS. Book them early; their calendar comes out of your 180 days.
Either way, the Affirming Official affirms again once the closeout is done.
What happens if you miss the 180 days?
The rule spells it out for both kinds of Level 2 status (§ 170.16 and § 170.17). The Conditional status for that information system expires. If that happens during a contract's period of performance, "standard contractual remedies will apply," and you're ineligible for additional awards that require that CMMC level until you achieve a new status. Getting one means a new assessment, not a late closeout.
Two related details:
- The three-year clock doesn't reset. After a successful closeout, your CMMC Status Date stays the date of the original Conditional status (§ 170.4). Your reassessment and annual affirmations count from there.
- Every step comes with an affirmation. You affirm on reaching Conditional status and again after the closeout. See what your Affirming Official is actually signing.
A POA&M isn't the only way to handle a gap
Not every problem found during an assessment belongs on a POA&M. The rule recognizes a temporary deficiency: something that broke after a requirement was implemented, where "a known fix is available or is in process," documented in an operational plan of action (§ 170.4). When it's handled that way, with deficiency reviews and visible progress, the requirement is assessed as MET (§ 170.24).
The difference matters. A POA&M covers requirements that aren't implemented yet. An operational plan of action covers a working control that has a temporary problem. Knowing which one you're looking at can be the difference between a NOT MET and a MET.
How to plan a POA&M you can actually close
- Fix the big ones first. Anything worth 3 or 5 points, and the six never-POA&M requirements, has to be met at assessment time. Start there.
- Keep the list short. Every POA&M item is work you’ve promised to finish in 180 days, on top of running the business.
- Name an owner and a date for each item. A POA&M without owners is a wish list.
- Aim to finish by day 120. That leaves time to gather evidence and schedule the closeout, especially if a C3PAO has to perform it.
- Finish the evidence, not just the fix. Evidence has to be in final form. Drafts, working papers, and unapproved policies don’t count.
Know your POA&M before the assessor does
The worst time to learn that a gap is worth 5 points is during the assessment. A mock assessment scored by CMMC Certified Assessors shows which gaps would fit on a POA&M, which ones would cost you the Conditional status, and how much room you have above 88. After the real assessment, Continuous Compliance tracks each item through closeout inside the 180 days.