Every company working toward CMMC Level 2 ends up with a Plan of Action and Milestones. For too many, it becomes the place where hard problems go to be forgotten: a spreadsheet tab that grows, never shrinks, and gets opened the week before someone asks for it.
What it is
A POA&M is a list of commitments. Each entry says: this requirement is not fully implemented, here is what we will do about it, here is who owns it, and here is when it will be done. Remove the owner or the date and what remains is a list of things you have admitted are wrong.
Why it matters to your score
Your SPRS score starts at 110 and loses points for every NIST SP 800-171 requirement that is not fully implemented. Each open POA&M item is a requirement you are not taking credit for. Closing items is how the score moves. A POA&M that does not change means a score that does not change.
Not everything is allowed on it
This is the part that surprises people. Under CMMC, a contractor can hold a conditional status with some items still open, but only above a threshold score, and only if the open items are ones the rule allows to be deferred. Some requirements are not eligible to sit on a POA&M at all. A gap in one of those is not a to-do item. It is a blocker. If you do not know which of your open items fall in that category, you do not know where you stand.
Four signs yours has become a parking lot
- Entries with no owner, or with a department as the owner. Departments do not close findings. People do.
- Due dates that have passed, quietly, more than once.
- Entries that describe the problem but not the fix.
- Nobody can say which items are eligible to stay open and which would stop an assessment.
What a working POA&M looks like
- Every gap traces to a specific requirement and the assessment objective that is not met.
- Every entry has a named owner, a due date, and milestones along the way.
- Overdue items surface on their own. Nobody has to remember to look.
- Ineligible gaps are flagged the moment they are recorded, so they get worked first.
- Closing an item updates the score, so leadership sees progress as a number.
How we handle it
The CMMC Level 2 Compliance Tracker treats the POA&M as part of scoring, not a separate document. Open a gap and it asks for an owner and a date. Miss the date and it flags the item. Record a gap in a requirement that cannot be deferred and it tells you so. Close the item and the SPRS score recalculates. All of it runs on your own machine.
The tracker is a readiness and management tool for your self-assessment. It does not grant certification. Confirm POA&M eligibility and conditional status rules against the current CMMC rule or with your assessor.