# CMMC POA&M Worksheet (Plan of Action and Milestones)

> Source: https://netray.co/tools/cmmc-poam-plan-of-action-milestones-worksheet
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

An editable POA&M tracker for NIST 800-171 gaps with owner, status, target date, estimated cost and a running cost total.

## Category

compliance-legal

## Industry

Defense Contracting

## Region

United States

## Audience

- Compliance manager
- IT security lead

## Tool

**Kind:** worksheet

**Mode:** editable

**Currency:** $

**Columns:**

#### Requirement

**Key:** req

**Type:** text

#### Weakness or gap

**Key:** weakness

**Type:** text

#### Owner

**Key:** owner

**Type:** text

#### Risk

**Key:** severity

**Type:** select

**Options:**

- Low
- Moderate
- High

#### Status

**Key:** status

**Type:** select

**Options:**

- Open
- In progress
- Closed

#### Target date

**Key:** target

**Type:** date

#### Estimated cost

**Key:** cost

**Type:** number

**Format:** currency

#### Effort (hours)

**Key:** effort

**Type:** number

**Format:** number

#### Labor cost at $95/hr

**Key:** blended

**Type:** number

**Expr:** effort * 95

**Format:** currency

#### Total cost

**Key:** total

**Type:** number

**Expr:** cost + effort * 95

**Format:** currency

**Rows:**

**Req:** 3.5.3 MFA

**Weakness:** MFA not enforced for remote ERP admin

**Owner:** IT Manager

**Severity:** High

**Status:** In progress

**Target:** 2026-12-15

**Cost:** 3200

**Effort:** 40

**Req:** 3.3.1 Audit logs

**Weakness:** File server logs not retained 12 months

**Owner:** Sysadmin

**Severity:** Moderate

**Status:** Open

**Target:** 2027-01-31

**Cost:** 1800

**Effort:** 24

**Req:** 3.8.3 Media sanitization

**Weakness:** No documented process for retired drives

**Owner:** Facilities

**Severity:** Low

**Status:** Open

**Target:** 2026-11-30

**Cost:** 250

**Effort:** 8

**Req:** 3.13.11 FIPS cryptography

**Weakness:** VPN uses non-validated module

**Owner:** Network Engineer

**Severity:** High

**Status:** In progress

**Target:** 2027-02-28

**Cost:** 9500

**Effort:** 60

**Req:** 3.2.1 Awareness training

**Weakness:** Annual CUI training not tracked

**Owner:** HR

**Severity:** Low

**Status:** Closed

**Target:** 2026-09-30

**Cost:** 600

**Effort:** 10

**Totals:**

#### Tool and vendor cost

**Key:** cost

**Agg:** sum

**Format:** currency

#### Total remediation cost

**Key:** total

**Agg:** sum

**Format:** currency

#### Items tracked

**Key:** req

**Agg:** count

**Format:** integer

**Summary:**

#### Average cost per item

**Key:** avg_item

**Expr:** sum_total / count

**Format:** currency

#### Largest single item

**Key:** max_item

**Expr:** max_total

**Format:** currency

**Notes:** Labor rate is set to $95 per hour in the formula; edit the column expression after export if your rate differs. Closed items should keep their evidence reference elsewhere. Scoring rules and which requirements may be on a POA&M at assessment time are set by the CMMC program rule, so confirm current rules before relying on it.

## Content

**Intro:** A plan of action and milestones records each unmet security requirement, who fixes it, by when and at what cost. This worksheet keeps it in a simple table with the cost math done for you, so you can sort, filter and export to Excel for the leadership review.

**Sections:**

#### How to use the worksheet

**Body:** Add one row per gap found in your self-assessment. Use the requirement number from NIST SP 800-171 so it maps back to your system security plan. Give each row one owner, a risk rating and a target date that is realistic, not aspirational. Update status weekly during remediation and export a snapshot to Excel for each management review.

**Bullets:**

- One owner per row, never a team name
- Rate risk by exposure to CUI, not by effort
- Review the High items first every cycle
- Keep closed rows for the audit trail

#### Why cost and effort are included

**Body:** Leadership funds what it can see. Showing tool cost plus labor hours per item turns a vague list of weaknesses into a budget request. The total column adds vendor spend and labor at a blended rate so the largest items stand out. Compare totals against the value of the contracts that depend on the requirement.

#### Reading the summary

**Body:** The average and maximum item cost reveal whether you have many cheap fixes or a few expensive projects. Many small, low-risk items are usually policy and documentation work that can close within a quarter. A few large items, such as cryptographic modules or network segmentation, drive the schedule and should be started first.

#### Common mistakes

**Body:** Teams often list a gap with no date, mark items closed before evidence exists, or treat the POA&M as a place to park requirements indefinitely. Under the CMMC program there are limits on what may remain open at assessment, so a POA&M is a bridge, not a permanent home for gaps.

**Cta:** Netray can help pull remediation evidence such as access reviews and audit exports from your ERP, on-prem, so your tracker stays current. The worksheet itself is free and needs no sign-up.

**Faq:**

#### What is a POA&M?

**Answer:** A plan of action and milestones lists security requirements that are not yet fully met, with the weakness, responsible owner, resources, milestones and completion date. It documents a managed path to compliance rather than leaving gaps undefined.

#### Can I use a POA&M to pass CMMC Level 2?

**Answer:** Only within the limits set by the CMMC program rule, which restricts which requirements may be open at assessment and how quickly they must close. Check the current rule and talk to your assessor before planning to rely on it.

#### How is this different from the SSP?

**Answer:** The SSP describes how requirements are met today. The POA&M lists what is not met and how you will close it. Each POA&M row should reference the matching SSP requirement number.

#### Can I change the labor rate?

**Answer:** Yes. The cost formula uses a fixed hourly rate in the column expression. After exporting to Excel, edit the formula or the rate cell to match your internal blended rate.

## Search terms

cmmc poam template excel, poa&m template nist 800-171, plan of action and milestones template, cmmc poam example, 800-171 poam spreadsheet, dfars poam tracker

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json