What is a POA&M?
A POA&M lists security weaknesses, the actions planned to fix them, the resources required, and milestone dates. It's common in federal programs, FedRAMP, and CMMC.
A plan of action and milestones (POA&M) is a document listing known security weaknesses or unmet requirements, the actions planned to fix them, the resources needed, who's responsible, and scheduled completion dates. POA&Ms are standard in U.S. federal security programs, including FISMA and FedRAMP, and are allowed on a limited basis under CMMC.
What a POA&M includes
- The weakness or unmet requirement
- Its source (assessment, scan, audit)
- Severity or risk rating
- Planned corrective actions and milestones
- Responsible owner and resources
- Scheduled and actual completion dates
POA&Ms under CMMC
CMMC allows limited POA&Ms at Levels 2 and 3 for certain requirements, which must be closed out within 180 days.
What to look for
For CMMC or FedRAMP, your POA&M should come from the same data as your findings: one list of weaknesses, owners, and dates.
Questions
Is a POA&M the same as a risk register?
No. A POA&M tracks specific weaknesses and how they'll be fixed. A risk register tracks risks more broadly, including ones you've accepted or transferred.
See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.