POA&M
Plan of Action & Milestones — the roadmap for closing security control gaps.
A POA&M is a formal document tracking outstanding security control deficiencies, the corrective actions required, owners, and target completion dates. DoD requires POA&Ms for any NIST 800-171 controls not fully implemented.
CMMC 2.0 allows a limited set of POA&M items at assessment time, but critical controls (worth 3 or 5 points on the scoring rubric) cannot be POA&M'd.
What a useful POA&M entry contains
Describe the affected requirement and the actual deficiency, not just a broad task such as improve security. Identify the impacted system, corrective action, responsible owner, expected completion date, dependencies, and evidence needed for closure. Record whether a temporary safeguard reduces exposure while the permanent fix is underway.
An example of actionable remediation
For an incomplete access review, the plan might identify the missing account inventory, assign the service owner to reconcile it, and require approval records plus a dated review as closure evidence. The task is not complete merely because a policy was written or a meeting was scheduled.
A plan does not waive the requirement
POA&M eligibility and closeout rules vary by program. Some gaps cannot remain open at assessment, and a documented promise is not equivalent to an implemented control. Review outstanding items regularly, explain missed milestones, and confirm the applicable rules before treating a plan as an acceptable assessment outcome.
Related terms
See how Scarlet Risk covers POA&M.
One platform for compliance, cyber, vendor, and world-watch risk.
Schedule Live Demo