A Plan of Action and Milestones (POA&M) lists the security requirements you have not met yet and how you will close them. Under CMMC, it is not a place to leave gaps open. 32 CFR 170.21 limits what can go on it and how long it can stay.

Level 1: no POA&M

A POA&M is not permitted at any time for a CMMC Level 1 self-assessment. Every one of the 15 requirements must be met.

Level 2: three conditions

You can reach a Conditional Level 2 status with a POA&M only if all of these are true:

  • Your assessment score divided by 110 is at least 0.8. That means a score of at least 88.- No requirement on the POA&M is worth more than 1 point under the CMMC scoring method. The one exception is SC.L2-3.13.11, CUI encryption, when encryption is in place but not FIPS-validated.- None of these requirements are on it: AC.L2-3.1.20 External Connections, AC.L2-3.1.22 Control Public Information, CA.L2-3.12.4 System Security Plan, PE.L2-3.10.3 Escort Visitors, PE.L2-3.10.4 Physical Access Logs and PE.L2-3.10.5 Manage Physical Access.## The 180-day closeout A POA&M closeout assessment checks only the NOT MET requirements on the POA&M. It must confirm they are closed within 180 days of your Conditional status date. For Level 2 (Self), you run the closeout the same way as the initial self-assessment and post the results in SPRS. If you miss the 180 days, your Conditional status expires. Under 32 CFR 170.16, you are then ineligible for new awards that require Level 2 (Self) or higher for that system until you achieve a new status. ## What to do now
  • Score all 110 requirements honestly.- Close the requirements that can never go on a POA&M first, starting with your SSP.- Put a date and an owner on every remaining item, and plan to finish well inside 180 days.CMMC Phase 2 is suspended, but contracts can still require Level 2 (Self), and these POA&M rules apply to it. ## Start here Cyberneza is a veteran-owned, 100% US-based cybersecurity and compliance firm in Orlando, Florida. Our free SPRS score worksheet shows your score and your gaps: https://cyberneza.com/sprs-score-worksheet Sources: 32 CFR 170.21, 32 CFR 170.16, 32 CFR 170.15