FAQ
POA&M management questions
The implementation questions DoD subcontractors actually ask.
POA&M stands for Plan of Action and Milestones. NIST SP 800-171 §3.12.2 requires it: a documented plan for closing any control that's not yet Implemented. The POA&M must list the corrective actions, milestones with target dates, and resources allocated. CMMC L2 assessments require POA&M evidence; L3 audits scrutinize it deeply.
Yes, but the rules are narrow. Under the CMMC Final Rule (32 CFR 170.21), only 1-point requirements are POA&M-eligible, and five of those are excluded and must be met at assessment: AC.L2-3.1.20, AC.L2-3.1.22, PE.L2-3.10.3, PE.L2-3.10.4, and PE.L2-3.10.5. Every 3-point requirement must be Implemented. So must every 5-point requirement, with one exception: SC.L2-3.13.11 (FIPS-validated encryption) can sit on a POA&M when encryption is deployed but not yet FIPS-validated, scoring 3 points off instead of 5. Conditional Level 2 status also needs a minimum SPRS score of 88 of 110, and every POA&M item must close within 180 days. The POA&M tracker shows the running SPRS score impact of each open item.
Evidence linkage (attached files), append-only audit trail (every change logged with user+timestamp), real-time SPRS score impact, one-click generation from risk register or control assessment, role-based access ("assigned to me" view per user), and CMMC §3.12.2-formatted PDF export for the C3PAO. None of which Excel does without custom macros.
Yes. The PDF export is filtered by date range, status, assignee, or scope (e.g., "all L2 POA&Ms open more than 30 days"). For the C3PAO assessor mode, they read the POA&M directly in the platform with the same audit logging.
Yes, for the corrective-action side. After an incident reported to DC3, the POA&M tracks the remediation milestones. The incident report itself lives in the Risk Register linked to the POA&M item. Both are scope for the assessor mode.
