PolicyCortex
Request Access

POA&M stands for Plan of Action and Milestones.

A Plan of Action and Milestones (POA&M) lists known control gaps and the plan to close them. Under CMMC, a limited set of non-critical controls may be POA&M'd to achieve conditional certification.

Conditional Level 2 status requires closing the POA&M items within 180 days, verified by a follow-on assessment. Critical controls generally cannot be POA&M'd.

Between 15% and 30% of first-attempt assessments end with open POA&M items — one reason a readiness review before the formal assessment materially lowers risk.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages, the architecture page, and the two pages on authorization.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where the evidence is stored in each delivery mode.
authorization
Continuous ATO. How an authorizing official's decision is recorded with its package, and how the authorized system is checked against it every hour.
baseline
NIST SP 800-53. The Low, Moderate and High baselines as evidence, with the SSP, SAR and POA&M generated from one record.

Related terms and reading

  1. SSP: System Security PlanAn SSP is the document describing how an organization implements each required security control across its in-scope environment.
  2. C3PAO: CMMC Third-Party Assessment OrganizationA C3PAO is an organization authorized by the Cyber AB to conduct official CMMC Level 2 certification assessments.
  3. SPRS: Supplier Performance Risk SystemSPRS is the DoD system where organizations post their NIST 800-171 self-assessment score and, under CMMC, their certification status and affirmations.

Know the term. Then see the record behind it.

Request AccessBook a call
Published
Last updated
Unchanged since publication