A Plan of Action & Milestones is the least glamorous document in the CMMC stack and the one most likely to be requested by a prime with no warning. It's also structurally simple — a table of what's not done, who owns it, and when it will be — which is exactly why the failures are so visible: gap lists with no dates, dates with no owners, and "ongoing" written in the milestone column. Here's the template that works, filled rows included. (New to the POA&M entirely? Start with the explainer; this post is the build guide.)
The Columns a Defensible POA&M Needs
| Column | What goes in it | The mistake to avoid |
|---|---|---|
| Item # | A stable ID you can reference from the SSP and status meetings | Renumbering every revision |
| Control | The NIST SP 800-171 requirement ID (e.g., SC.L2-3.13.11) | Grouping several controls into one vague row |
| Weakness | Plain statement of what's missing, specific to your environment | Restating the requirement instead of the gap |
| Points | The control's DoD weight (1, 3, or 5) — this is your prioritization column | Omitting it and fixing easy 1-pointers first |
| Owner | A named person, even in a five-person shop | "IT" is not an owner |
| Resources | Budget, tooling, or outside help required | Pretending remediation is free — assessors read this column for realism |
| Milestones | Interim, dated steps for anything longer than a month | One milestone that just repeats the completion date |
| Completion date | The date you're committing to — feeds the SPRS field directly | "Ongoing," "TBD," or a date nobody believes |
| Status | Open / in progress / completed, with the completion evidence noted | Closing items without recording what proved them closed |
Two Example Rows, Filled In
Item 7 · SC.L2-3.13.11 · 5 points. Weakness: CUI at rest on three engineering laptops is encrypted with BitLocker in a non-FIPS mode. Owner: J. Rivera. Resources: none — configuration change plus re-encryption window. Milestones: enable FIPS-compliant algorithms via GPO (Aug 22); re-encrypt and verify all three devices (Sep 5). Completion: Sep 5, 2026. Status: in progress.
Item 12 · CA.L2-3.12.1 · 5 points. Weakness: no recurring internal assessment of control effectiveness has been performed. Owner: D. McLain. Resources: 8 hours/quarter. Milestones: adopt quarterly review checklist (Aug 29); complete first review cycle (Oct 3). Completion: Oct 3, 2026. Status: open.
Note what makes these work: the weakness names real systems, the points column justifies why these two jumped the queue, and each date is one someone agreed to. Six honest columns beat sixteen empty ones.
The Two Rulebooks — Don't Mix Them Up
POA&M confusion almost always comes from blending two regimes that share the document but not the rules:
- SPRS self-assessment (in force today, suspension or not). Any unmet control may sit on the POA&M. Unmet still subtracts its points from your score — the POA&M doesn't buy points back — and the portal asks for your overall completion date. That's the whole rulebook.
- CMMC Level 2 certification (paused, returning in some form). Stricter: a Conditional status requires a score of at least 88, the highest-weight requirements — including MFA and FIPS encryption — cannot be open POA&M items at assessment, and everything on the list must close within 180 days or the status lapses.
The planning consequence: if certification is in your future, sequence remediation so the un-POA&M-able controls are done first. A contractor who spends the pause closing 5-pointers arrives at the restart already eligible; one who parked MFA on a POA&M arrives ineligible by rule.
A POA&M that builds and maintains itself
CMMC Map derives your POA&M from your actual assessment — every unmet control, weighted and dated — and closes items automatically when the underlying control status changes. Free to assess; the generated documents are $149/month.
See your gap list — free →Maintenance Is the Actual Deliverable
A POA&M is evidence of management, and management is recurring: review it monthly, move milestones with a note when reality moves, record what evidence closed each item, and keep superseded versions. When your posture improves, update your SPRS score — a rising score with a shrinking POA&M is the single best supplier-risk story you can show a prime, and it costs nothing but the honesty of keeping both current.