Plan of Action and Milestones (POA&M) Template
A Plan of Action and Milestones records a known security gap, who will fix it, with what and by when. This template produces a clean entry you can add to your system security plan records or hand to an assessor.
Fill in
Use the SP 800-171 requirement number.
Plan of Action and Milestones (POA&M) Template
Plan of Action and Milestones
Company: Acme Precision Ltd System: CUI Engineering Enclave Item: POAM-007 Prepared for the system security plan of the environment named above.
Weakness identification
Requirement: 3.5.3 (Identification and Authentication) Risk level: Moderate
Weakness: Multifactor authentication is enforced for remote access but not for local logon to two engineering workstations that process CUI.
Ownership and resources
Responsible owner: IT Manager Resources required: Hardware tokens for 12 users, 40 hours of administrator time, change window approval. Start: 2026-11-02 Scheduled completion: 2027-01-29
Milestones
| Step | Milestone | Target date | Status |
|---|---|---|---|
| 1 | Select token or authenticator and approve purchase | Not started | |
| 2 | Pilot with five users and update procedures | Not started | |
| 3 | Enforce for all CUI workstations and collect evidence | 2027-01-29 | Not started |
Interim compensating measures
Physical access restricted to badge holders; workstation logon events forwarded to the log platform and reviewed weekly.
Verification
Evidence to be retained: configuration screenshots, change record, updated procedure and test result.
Completion verified by an independent reviewer who did not implement the change.
Approvals
A starting point, not legal advice. Whether and how POA&M items are permitted for a given CMMC level or contract is set by the program rules and your contract, so check current requirements. Keep one item per gap and update status regularly.
Optional gap tracking setup
We can help turn your POA&M list into tracked tasks with owners and due dates in the tools you already use.
Optional. The tool and every export work without this. No spam.
How to use it
Create one document per gap. Enter the requirement number, the family and a plain description of what is missing. Name a single owner, list the resources, and set a start and completion date. Break the fix into three milestones so progress is visible, and describe any interim measures that reduce risk until the gap closes. Export to PDF or Word, then store it with your other compliance records.
- Describe the weakness in observable terms, not opinions.
- Give each milestone a date and an owner.
- Record the evidence you will keep.
What a good entry contains
Assessors look for a specific weakness, a realistic schedule, assigned responsibility and evidence that the fix works. NIST SP 800-171 expects organizations to develop and implement plans of action to correct deficiencies and reduce or eliminate vulnerabilities. Interim measures show that you manage risk in the meantime, but they do not replace the requirement. Verification by someone other than the implementer strengthens the record.
Common mistakes
Vague entries such as improve access control give no way to tell when the item is complete. Another mistake is setting a due date years away, which signals a lack of intent. Do not mark an item closed without evidence, and do not rely on POA&M items to cover requirements that the contract or program rules say must be fully met at the time of assessment. Review open items monthly.
Frequently Asked Questions
Is a POA&M the same as a system security plan?
No. The system security plan describes how each requirement is implemented. A POA&M lists the requirements not yet fully met and the plan to fix them. They should stay consistent with each other.
How many milestones should an item have?
Three to five is typical. Each should be a visible step with a date, such as purchase, pilot and full rollout, so reviewers can see progress.
Can I close an item without evidence?
No. Keep proof such as configuration records, change tickets, test results and updated procedures. Closure without evidence is a common reason for findings.
Are POA&M items always allowed at assessment?
Not always. Rules depend on the program level, the requirement and your contract. Check the current official guidance rather than assuming any gap can be deferred.
If you want ERP-related gaps, such as role design or audit trails, turned into tracked tasks automatically, we can help build that on your own infrastructure.
Related Tools
CMMC Level 2 Remediation Budget Calculator
Turn a gap count and CUI headcount into a first-year CMMC Level 2 budget, with a sweep showing how cost scales with the number of CUI users.
Aerospace & DefenseDFARS Flowdown Subcontractor Risk Tracker
An editable worksheet that records CUI exposure, flowdown status and cyber maturity per subcontractor and scores risk so you know whom to chase first.
Aerospace & DefenseNIST 800-171 Audit Log Storage Sizing Calculator
Estimate gigabytes per day, online searchable storage and compressed archive storage for the audit logs your CUI environment must produce and keep.
Aerospace & DefenseCUI Enclave vs Enterprise Scope Cost Calculator
Model whether a dedicated CUI enclave is cheaper than bringing every user into scope, with a break-even CUI headcount and a what-if chart.
More Compliance & Contracts tools
See all- Export Compliance Program ROI Calculator
- SAP SoD Residual Risk Score Calculator
- SAP Firefighter ID Usage Review Log
- IBM i (AS/400) User Profile Access Review Worksheet
- SyteLine Security and User Access Audit Checklist
- Infor XA (MAPICS) User Access Review Worksheet
- China ERP Data Security and Compliance Assessment
- ERP Vendor Data Processing Agreement Outline
- GDPR ERP Data Migration Checklist