Last reviewed October 13, 2026.
A plan of action and milestones (POA&M) lets a contractor carry a small number of unmet requirements past an assessment and fix them afterward. Under the CMMC rule, the allowance is narrow. This guide summarizes the conditions in 32 CFR 170.21 for Level 2, so you know what you can defer and what you cannot.
The minimum score
A POA&M is allowed only if your assessment score divided by the 110 Level 2 requirements is at least 0.8. That works out to a minimum score of 88 out of 110. Below that, a conditional status is not available.
Which requirements can go on a POA&M
Only requirements worth 1 point can be included, with one exception: SC.L2-3.13.11, which covers encryption of CUI that is not FIPS-validated. Requirements worth 3 or 5 points must be fully implemented before the assessment.
Requirements that can never be on a POA&M
Six Level 2 requirements are excluded regardless of their point value:
- AC.L2-3.1.20: verify and control connections to external systems
- AC.L2-3.1.22: control CUI posted or processed on publicly accessible systems
- CA.L2-3.12.4: develop and maintain the system security plan
- PE.L2-3.10.3: escort visitors and monitor visitor activity
- PE.L2-3.10.4: maintain audit logs of physical access
- PE.L2-3.10.5: control and manage physical access devices
Level 1 has no POA&M allowance at all.
The 180-day clock
If you reach a conditional status with open POA&M items, the closeout must be confirmed within 180 days of the conditional status date. If the items are not successfully closed out in that time, the conditional status expires.
How to use a POA&M well
- Fix the heavy requirements first. Multi-factor authentication, encryption, logging and other 3- and 5-point items cannot be deferred, so they drive your readiness timeline.
- Keep the list short. A POA&M is a bridge for a few low-weight items, not a plan to defer a program.
- Write real milestones. Give each item an owner, a date inside the 180-day window and evidence that closes it.
- Do not forget the six exclusions. Visitor controls, physical access logs and a current system security plan are common surprises.
Where this stands today
These rules are part of the CMMC program rule. DoD suspended third-party certification as a condition of award on July 13, 2026. The suspension does not change the underlying NIST SP 800-171 obligations, and a contractor that prepares to this standard is ready if the program resumes. See our update on the Phase 2 suspension.
To see where you stand, start with a gap assessment, then calculate your SPRS score. Cyberix builds the POA&M, tracks it to closure and runs the monitoring behind it through our CMMC and NIST SP 800-171 compliance services.
What a POA&M entry should contain
- The requirement identifier and a plain description of the gap.
- The point value of the requirement and the risk the gap creates.
- A named owner and the resources committed.
- Milestones with dates that fall inside the 180-day window.
- Current status and, when closed, the evidence that shows it.
Common POA&M mistakes
- Listing requirements that are not eligible, such as the six that can never be deferred.
- Setting dates that run past 180 days, which cannot support a conditional status.
- Closing items without evidence. A closeout has to be demonstrable.
- Using the POA&M as a to-do list. Routine follow-ups, such as ongoing patching, are not assessment gaps and should not crowd out the items that matter.
- Having no owner. An item without a responsible person rarely closes on time.
Talk to a Cyberix compliance expert about your NIST SP 800-171 and CMMC readiness.
Frequently Asked Questions
What is a POA&M in CMMC?
A plan of action and milestones documents the requirements you have not yet met, the steps to meet them and the dates. Under the CMMC rule, a limited number of items can remain open after a Level 2 assessment if strict conditions are met.
What score do I need to use a POA&M?
At least 88 out of 110, which is a score of 0.8 or higher across the 110 Level 2 requirements.
How long do I have to close POA&M items?
180 days from the conditional status date. If they are not successfully closed out, the conditional status expires.
Can I put multi-factor authentication on a POA&M?
No. Only 1-point requirements can be included, apart from the encryption exception, and multi-factor authentication carries more weight than that.
Is a POA&M allowed at Level 1?
No. A POA&M is not permitted at any time for Level 1 self-assessments.
This article is general information, not legal advice. Confirm which clauses apply to your contracts with qualified counsel or your contracting officer.
To see which of your gaps could sit on a POA&M, try the free SPRS score calculator. It flags unmet requirements worth more than one point and the six that can never be deferred.