CMMC 2.0 requirements are where many defense contractors get tripped up by a well-meaning plan: the Plan of Action and Milestones. A POA&M is useful. It documents a gap, assigns an owner, and sets a date to close it. What it is not is a substitute for implementation. Under CMMC 2.0 requirements, POA&M use is limited and time-bound, and some practices need to be in place before you walk into an assessment — not promised for later.
That distinction decides contracts. If your CMMC assessment preparation treats every open item as POA&M-eligible, you will discover the limit at the worst possible moment: during scoping, during evidence review, or when a prime asks for proof you cannot yet produce. The fix is earlier and simpler. Sort your gaps now into what must close first, what can legitimately ride a POA&M, and what was never really a gap because the evidence was missing, not the control.
A POA&M documents a gap. It does not close one
A good POA&M is honest and specific: the practice that is not yet met, the risk it leaves open, the exact fix, the person who owns it, the resources it needs, and a milestone date you can actually hit. A weak POA&M is a parking lot — vague language, no owner, and a date chosen because it sounds reasonable.
Assessors and customers can tell the difference quickly. If the same item has rolled from one POA&M version to the next with a new date and no progress, that is not a plan. It is a record that the practice has been unmet for longer, with full knowledge.
Keep one rule in front of the team: score what is implemented today. Your SPRS score, your System Security Plan, and your POA&M should tell the same story. When they do not, the least flattering version is the one that gets believed — and discrepancies create risk well beyond the assessment itself, including how a prime or a contracting officer views the accuracy of what you submitted.
For San Diego contractors building toward CMMC compliance San Diego customers and primes can trust, that honesty is not a weakness. It is how you show the work is managed, not improvised.
Sort gaps into three buckets before you schedule anything
Start with a current, practice-by-practice review against NIST 800-171 compliance — all 110 practices for Level 2 — inside your actual CUI boundary. Then sort every gap:
Bucket 1: Must close before assessment. Foundational practices that other controls depend on, and practices where a POA&M is not a safe assumption. Multi-factor authentication for remote and privileged access, proper access control and least privilege, audit logging that is actually collected and reviewed, encryption and boundary protection where CUI moves, and an incident response capability people can describe and have practiced. If users cannot explain how to report a suspected incident, the plan on paper has not been implemented.
Bucket 2: Legitimately POA&M-able, with a real closeout plan. A narrow, documented gap with a funded fix, a named owner, and a date inside the window allowed for POA&M closeout — for example, completing a tool rollout to the last few in-scope devices, or finishing a documented process that is already operating informally. The key tests: the scope is small, the end state is defined, and progress can be shown week to week, not just promised at the deadline.
Bucket 3: Evidence gaps, not control gaps. The practice is operating, but you cannot prove it — no retained logs, no access-review records, no training completion list, no test of a backup restore. These do not belong on a long POA&M at all. They close by producing and organizing evidence now, and by fixing the process so evidence is created as a byproduct of normal work, not reconstructed before an assessment.
This sorting exercise is the heart of CMMC assessment preparation. It turns a long, flat list of findings into a sequence: close Bucket 1, prove Bucket 3, and carry only a short, credible Bucket 2 into the assessment conversation.
The common POA&M traps
Four patterns show up repeatedly:
- Deferring the foundation. Putting MFA, logging, or access control on a POA&M while polishing lower-impact documentation first. Order matters: foundational gaps undermine confidence in everything built on top of them.
- Scope creep in the POA&M. An item written for one system quietly covers a whole department. Keep each item tied to a specific practice, system, and boundary — the same boundary your SSP describes.
- Dates without resourcing. A milestone with no budget, no assigned engineer, and no scheduled change window is not a milestone. If the fix requires a tool, a vendor, or downtime, name that dependency in the plan.
- Closing on paper only. Marking an item complete because a policy was written, before the setting was enforced and tested. Close an item when it operates and you have evidence — a configuration export, a log sample, a completed review — not when the document is drafted.
Subcontractors face one more trap: assuming the prime’s POA&M covers them. Flow-down means your environment, your evidence, and your gaps are yours. If a sub handles CUI for you, get their status in writing the same way — which practices are met, which are open, and on what dates they close.
Run closeout like operations, not a project sprint
POA&M items die in the gap between assessment projects. Assign a short recurring review — weekly while Bucket 1 items are open — where each owner reports progress with evidence, not activity. “Working on MFA” is activity. “MFA enforced for remote access for all enclave accounts; three legacy accounts remain, listed here, closing Friday” is progress.
Fold closeout into normal operations wherever you can. Access reviews, patching and vulnerability scanning, log review, and backup tests should run on a schedule owned by your regular IT operation through disciplined managed IT services and monitored around the clock. Continuous monitoring from a Security Operations Center helps in two practical ways: it catches credential abuse and control failures between assessments, and the review records it produces double as evidence that monitoring practices are operating, not just configured. That is core work for CMMC and government-contractor IT support and managed cybersecurity services, not a side task added the month before an assessor arrives.
When an item closes, update everything the same day: the POA&M, the SSP if the implementation description changed, and your SPRS score if the practice is now met. Leaving closed items scored as unmet undersells your readiness; claiming them early oversells it. Both errors erode trust.
A short readiness check you can run this week
Pull your current POA&M and ask five questions:
- Does every item name one practice, one owner, and one dated milestone?
- Is anything foundational — MFA, access control, logging, incident response — sitting on the POA&M with no funded, scheduled fix?
- Could you show progress evidence from the last two weeks for every open item?
- Does your SPRS score match what is actually implemented today — no more, no less?
- If a prime asked for your POA&M and SSP tomorrow, would they tell the same story?
If any answer is no, you have found your next two weeks of work — while it is still inexpensive to fix.
CMMC 2.0 requirements do not demand perfection on day one. They demand a truthful boundary, foundational practices actually implemented, and a short POA&M that closes on schedule. Build that, and the assessment becomes a verification of work you already do, not a test of work you promised.
Stop carrying gaps that a POA&M cannot carry. FIT Solutions is a San Diego managed IT and cybersecurity provider supporting defense contractors with CMMC readiness, NIST 800-171 compliance, and 24/7 monitoring from our California Security Operations Center. Our services include Managed IT, Enterprise IT, Cybersecurity, Cloud Services, and Healthcare IT, backed by 300+ 5-star Google reviews. Call FIT Solutions at (888) 339-5694. We are located at 550 West B Street, Suite 202, San Diego, CA 92101, and our vision is helping 6,000 businesses realize their goals through technology.
