# NIST 800-171 POA&M Worksheet

> Source: https://netray.co/tools/nist-800-171-poam-worksheet
> Publisher: Netray (netray.co), AI and integration engineering for ERP and manufacturing systems.
> Section: Free Tools

## Short answer

An editable plan of action and milestones for NIST SP 800-171 gaps, with owner, cost, due date, status and the SPRS points each fix recovers.

## Category

aerospace-defense

## Industry

Defense Contracting

## Region

United States

## Audience

- Compliance manager
- IT security lead
- Defense supplier owner

## Tool

**Kind:** worksheet

**Mode:** editable

**Currency:** $

**Columns:**

#### Requirement ID

**Key:** req

**Type:** text

#### Family

**Key:** family

**Type:** select

**Options:**

- Access Control
- Awareness and Training
- Audit and Accountability
- Configuration Management
- Identification and Authentication
- Incident Response
- Maintenance
- Media Protection
- Personnel Security
- Physical Protection
- Risk Assessment
- Security Assessment
- System and Communications Protection
- System and Information Integrity

#### Weakness / gap

**Key:** gap

**Type:** text

#### Planned remediation

**Key:** fix

**Type:** text

#### Owner

**Key:** owner

**Type:** text

#### Score points recovered

**Key:** points

**Type:** number

#### Estimated cost

**Key:** cost

**Type:** number

**Format:** currency

#### Effort (hours)

**Key:** hours

**Type:** number

#### Target date

**Key:** due

**Type:** date

#### Status

**Key:** status

**Type:** select

**Options:**

- Not started
- In progress
- Blocked
- Done, pending evidence
- Closed

#### Points per $1,000

**Key:** ppc

**Type:** number

**Expr:** if(gt(cost,0), points / cost * 1000, 0)

**Format:** decimal

**Rows:**

**Req:** 3.5.3

**Family:** Identification and Authentication

**Gap:** MFA not enforced for all users

**Fix:** Enable MFA on VPN, email and ERP

**Owner:** IT manager

**Points:** 5

**Cost:** 4500

**Hours:** 40

**Due:** 2026-12-15

**Status:** In progress

**Req:** 3.13.11

**Family:** System and Communications Protection

**Gap:** Encryption not FIPS validated

**Fix:** Move to FIPS-validated crypto modules

**Owner:** Network engineer

**Points:** 3

**Cost:** 9000

**Hours:** 60

**Due:** 2027-01-31

**Status:** Not started

**Req:** 3.3.1

**Family:** Audit and Accountability

**Gap:** Logs not centrally retained

**Fix:** Deploy on-prem log collector

**Owner:** Security analyst

**Points:** 3

**Cost:** 12000

**Hours:** 80

**Due:** 2027-02-28

**Status:** Not started

**Req:** 3.2.1

**Family:** Awareness and Training

**Gap:** Training records incomplete

**Fix:** Annual training with tracked completion

**Owner:** HR

**Points:** 1

**Cost:** 1200

**Hours:** 12

**Due:** 2026-11-30

**Status:** Done, pending evidence

**Req:** 3.8.3

**Family:** Media Protection

**Gap:** Media sanitisation not documented

**Fix:** Write and enforce disposal procedure

**Owner:** Facilities

**Points:** 1

**Cost:** 600

**Hours:** 10

**Due:** 2026-11-15

**Status:** In progress

**Totals:**

#### Total points to recover

**Key:** points

**Agg:** sum

**Format:** integer

#### Total estimated cost

**Key:** cost

**Agg:** sum

**Format:** currency

#### Total effort

**Key:** hours

**Agg:** sum

**Format:** hours

**Summary:**

#### Average cost per score point

**Key:** cost_pt

**Expr:** if(gt(sum_points,0), sum_cost / sum_points, 0)

**Format:** currency

#### Open items listed

**Key:** items

**Expr:** count

**Format:** integer

**Notes:** Requirement IDs follow NIST SP 800-171 numbering. Example rows are illustrative. Closed items still need supporting evidence, and a plan of action does not raise your score until the requirement is fully implemented.

## Content

**Intro:** A plan of action and milestones, or POA&M, lists each unmet NIST SP 800-171 requirement with an owner, a fix and a date. It is the working document that turns a low score into a funded project. This worksheet adds cost and points so you can prioritise.

**Sections:**

#### How to use the worksheet

**Body:** Create one row per unmet requirement from your self-assessment. Write the weakness in plain words, the planned remediation, an owner, a target date and an estimate of cost and effort. Enter the SPRS points the fix will recover. The sheet computes points per thousand dollars so you can spot cheap wins, and the totals show the budget and effort needed to reach your score target.

#### Prioritising what to fix first

**Body:** Start with items that recover the most points for the least cost, especially five-point requirements such as multifactor authentication. Group fixes that share a tool or project, since one logging platform can close several audit requirements at once. Items that are blocked by procurement or architecture decisions should be visible in the status column so leadership can unblock them.

**Bullets:**

- Sort by points per $1,000 to find quick wins
- Group related controls into shared projects
- Keep blocked items visible with an escalation owner
- Retain evidence for every closed item

#### POA&M and your SSP

**Body:** The POA&M works alongside the system security plan. The plan describes how each requirement is met today, and the POA&M describes what is not yet met and how you will close it. Keep them consistent: a requirement marked implemented in the plan should not also appear as open here. Update both after each remediation sprint and again before you post a new score.

#### Common mistakes

**Body:** Frequent problems are vague fixes with no owner, dates that never move because nobody reviews the list, and closing items without evidence. Some teams also count planned work toward their score, which the scoring method does not allow. Review the sheet monthly, record changes of date with a reason, and keep cost estimates honest so budget requests are credible.

**Cta:** If remediation evidence is scattered across systems, Netray can help collect configuration and log evidence privately on-prem to support closing items.

**Faq:**

#### What is a POA&M?

**Answer:** A plan of action and milestones is a document that lists weaknesses, the actions planned to correct them, responsible people, resources and target dates. For NIST SP 800-171 it tracks requirements not yet fully implemented.

#### Does a POA&M count as implementation?

**Answer:** No. Under the DoD scoring method a requirement is credited only when it is implemented. A POA&M shows intent and accountability but does not raise your score until the work is complete and evidenced.

#### How often should I update it?

**Answer:** Review it at least monthly and after any remediation milestone. Update dates, status and cost as facts change, and keep a record of why dates moved so assessors can see the plan is actively managed.

#### How is this related to CMMC?

**Answer:** CMMC Level 2 assessments look at the same 110 NIST SP 800-171 requirements, and limited use of POA&Ms may be permitted for certain items under the rules. Confirm current CMMC program rules for which items may stay open.

## Search terms

nist 800-171 poam template, plan of action and milestones template excel, poa&m worksheet defense contractor, cmmc poam template, nist 800-171 remediation tracker, poam spreadsheet nist, 800-171 gap tracking, sprs remediation plan

---
Talk to an engineer: https://netray.co/contact?intent=erp_ai | Machine catalog: https://netray.co/agent/catalog.json