Register:Glossary3 recordsSHA3-256 chainedhead sha3:7c8eb1be7fa18bea9d8440c3b6b25d41e98e16b5c4d64e80a0b7c8d5f9f72f08Intact
REC 0001DEFINITIONsha3-256bbf188a56e8126127f2bf7917bd4d6d3c1e414f33bfd852f0aca5d2ffdcac617prev:158585c85b2a

POA&M stands for Plan of Action and Milestones.

A Plan of Action and Milestones (POA&M) lists known control gaps and the plan to close them. Under CMMC, a limited set of non-critical controls may be POA&M'd to achieve conditional certification.

Conditional Level 2 status requires closing the POA&M items within 180 days, verified by a follow-on assessment. Critical controls generally cannot be POA&M'd.

Between 15% and 30% of first-attempt assessments end with open POA&M items — one reason a readiness review before the formal assessment materially lowers risk.

REC 0002RELATED RECORDSsha3-2567c8eb1be7fa18bea9d8440c3b6b25d41e98e16b5c4d64e80a0b7c8d5f9f72f08prev:bbf188a56e81

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Related terms and reading

  1. SSP: System Security PlanAn SSP is the document describing how an organization implements each required security control across its in-scope environment.
  2. C3PAO: CMMC Third-Party Assessment OrganizationA C3PAO is an organization authorized by the Cyber AB to conduct official CMMC Level 2 certification assessments.
  3. SPRS: Supplier Performance Risk SystemSPRS is the DoD system where contractors post their NIST 800-171 self-assessment score and, under CMMC, their certification status and affirmations.

Know the term. Then see the record behind it.

Request AccessBook a call
Sealed
Last amended
Unchanged since sealing
Register colophonRecomputable by a second party
SeqLabelSHA3-256Prev
REC 0000HEAD158585c85b2a95acd212024c
REC 0001DEFINITIONbbf188a56e81158585c85b2a
REC 0002RELATED RECORDS7c8eb1be7fa1bbf188a56e81

The record headers on this page are SHA3-256 digests of this page's own copy, chained in sequence from a fixed genesis value. Edit one word of any record's copy above and every digest after it changes. Head of chain: sha3:7c8eb1be7fa1. The product does the same thing to your evidence.