What Is a POA&M? (And Which Gaps Are Eligible)
A POA&M is how you affirm a Conditional Level 2 status with a small number of gaps still open — provided those gaps are eligible to be deferred. Here's what qualifies and how long you have.
What a POA&M is
A Plan of Action and Milestones (POA&M) documents each unimplemented requirement, the plan to remediate it, and a milestone date. In SPRS terms, it's what lets you post a Conditional status instead of waiting until every requirement is fully implemented. Plans of action do not earn score credit — a requirement on a POA&M is still scored as not implemented.
Which gaps are POA&M-eligible (32 CFR 170.21)
A Conditional status requires all of the following to be true:
- Your score divided by 110 is at least 0.8 (a score of 88 or higher).
- No POA&M item is worth more than 1 point — with one exception: SC.L2-3.13.11 may be on a POA&M when encryption is employed but not FIPS-validated (the 3-point case).
- None of six specific requirements are on the POA&M: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4, PE.L2-3.10.5.
When a gap is disqualifying
If a not-met requirement is not POA&M-eligible — for example a 5-point requirement, or one of the six listed above — you cannot reach a Conditional or Final status regardless of your numeric score. The result is No CMMC Status. Knowing which of your gaps are deferrable versus disqualifying is often more important than the score itself.
The 180-day clock
A Conditional Level 2 self-assessment is valid for 180 days. You must close the POA&M via a closeout assessment within that window to reach Final, or the status expires. Treat the milestone dates as real deadlines, not placeholders.
Key takeaways
- A POA&M earns no score credit — the requirement is still 'not implemented.'
- Conditional needs score ÷ 110 ≥ 0.8 and no POA&M item worth more than 1 point (except 3.13.11 at 3).
- Six requirements can never be on a POA&M.
- A non-eligible gap means No CMMC Status, regardless of score.
- Close the POA&M within 180 days or the Conditional status expires.
Know your score before you submit
Run a full 110-requirement self-assessment free — no account required to see your score.
Start free assessmentSources
SentryNexus is a preparation and self-assessment tool. It does not connect to or submit anything to SPRS, and it is informational support only — not legal or compliance certification advice.