Reference · Cybersecurity & CMMC
POA&M
Plan of Action and Milestones
A Plan of Action and Milestones (POA&M) is a document listing a contractor's unmet security requirements, the corrective actions planned for each, and the dates they will be completed. In NIST SP 800-171 and CMMC, it is how open gaps are tracked to closure.
What it is
For each requirement a contractor does not yet meet, the POA&M records the deficiency, the remediation steps and resources, and a target completion date. Paired with the System Security Plan, it turns a point-in-time gap into a documented, dated path to compliance.
Why it exists
It gives the government and assessors a defensible remediation roadmap instead of a bare pass/fail snapshot, and it is how a contractor demonstrates it is closing gaps over time.
Who it applies to
Contractors self-assessing or being assessed against NIST SP 800-171 or CMMC. Note that CMMC limits which requirements may be placed on a POA&M and for how long — a conditional certification must be closed out within a set window.
Frequently asked
What is the difference between a POA&M and an SSP?
An SSP describes how a system meets its security requirements; a POA&M tracks the requirements it does not yet meet and the plan to close them. The SSP is the current state; the POA&M is the remediation roadmap for the gaps.
This is the kind of compliance signal Longlead reads to infer which upcoming defense projects will need cleared or compliance-ready scope — delivered as a cited evidence dossier with your confidence and lead time, 12–24 months before it surfaces as a named solicitation. You make the call, from your own channels; nothing leaves the system.
Or just see what Longlead finds for your scope.
Tell us what you sell and what you don't — and see the demand Longlead is inferring for you right now.