The CMMC framework requires that for an Organization Seeking Certification (OSC) to achieve certification, all applicable practices must be fully implemented and assessed as "MET." A Plan of Action & Milestones (POA&M) is a document that identifies and tracks tasks needed to remediate security deficiencies; it is not a substitute for the actual implementation of a security requirement. During a CMMC assessment, a partially implemented practice, even if the remainder is documented in a POA&M, will be found "NOT MET." The assessment is a point-in-time evaluation of the current security posture, not future intentions. Therefore, a POA&M cannot be used to satisfy a CMMC practice requirement.

B. A POA&M is evidence of a plan to achieve full implementation, not evidence that implementation is already complete.
C. Listing a practice in a POA&M explicitly acknowledges that it is not fully implemented, which is the opposite of being considered implemented.
D. CMMC assessors are required to verify the actual implementation of practices using objective evidence; they are not permitted to accept a POA&M as a substitute. ---

1. U.S. Department of Defense (DoD), "Cybersecurity Maturity Model Certification (CMMC) Program," Proposed Rule, 32 CFR Part 170, Federal Register, Vol. 88, No. 246 (Dec. 26, 2023).

Section § 170.19(c)(2): "For a CMMC Level 2 Self-Assessment... The senior official of the OSC must affirm... that all CMMC security requirements not yet fully implemented have been documented in a Plan of Action and Milestones (POA&M)..." This shows a POA&M is for requirements that are not yet fully implemented.

Section § 170.21(a)(2): Discusses the results of a CMMC Level 2 Certification Assessment, stating the C3PAO determines a "CMMC Level 2 Final Assessment Finding of MET for each CMMC security requirement..." This confirms that requirements must be "MET," not planned in a POA&M, for a standard certification.

2. The Cyber AB, "CMMC Assessment Process (CAP) v5.1.1," (March 2023).

Section 4.3, Assessment Findings, Page 18: "The Assessment Team makes a finding for each practice within the assessment scope... The finding is based on the sufficiency of objective evidence collected... The possible findings are MET, NOT MET, or NOT APPLICABLE (N/A)." This process does not include an option for "MET via POA&M," reinforcing that a practice must be fully implemented to be considered MET.

3. U.S. Department of Defense (DoD), "CMMC Model 2.0," (November 2021).

CMMC 2.0 Program Briefing, Page 10: Under the "Accountability & Enforcement" section, it notes that for Level 2, "Select acquisitions will allow for POA&Ms." This allowance is a limited exception for a conditional certification and does not change the fundamental rule that the practice itself is still "NOT MET" at the time of assessment. The POA&M is not a substitute for completion.