Who Checked the AI Agent’s ID at the Front Door?
November 9, 2026
CMMC: Understanding the DifferenceBetween a POA&M and an OPA
BLOG
5 min.
Understanding the difference between a Plan of Action & Milestones (POA&M) and an Operational Plan of Action (OPA) starts with recognizing that these two documents serve different purposes under 32 CFR Part 170 (the CMMC Program).
TL;DR – LA Plan of Action & Milestones (POA&M) and an Operational Plan of Action (OPA) serve fundamentally different purposes under CMMC and confusing the two is one of the fastest ways to stall your certification.
- A POA&M is tied to a C3PAO assessment finding, carries a 180-day closure deadline and directly impacts certification
- An OPA tracks temporary vulnerabilities found during normal operations with no fixed timeline or certification consequence
- Most compliance failures come from documentation mistakes, not security gaps
The Key Attributes of a POA&M and OPA
A POA&M is a formal remediation plan created in response to a C3PAO assessment finding where a security requirement is marked “Not Met”. It carries a strict 180-day closure deadline and directly impacts CMMC certification. An OPA, by contrast, tracks temporary vulnerabilities discovered during normal operations and carries no fixed deadline or certification consequence.
The following table provides a side-by-side comparison of the key attributes that distinguish these two documents.
| Attribute | POA&M (Plan of Action & Milestones) | OPA (Operational Plan of Action) |
|---|---|---|
|
Purpose
|
Documents NOT MET security requirements found during a CMMC assessment; tracks remediation to full compliance
|
Documents ongoing operational security activities, continuous improvement and risk management
|
|
Time-Bound
|
Yes — strict 180-day remediation deadline
|
No — ongoing with no fixed deadline
|
|
Trigger
|
Created when a practice is scored NOT MET during a C3PAO assessment
|
Created proactively as part of ongoing security operations
|
|
Certification Impact
|
Allows conditional CMMC Level 2 certification
|
Cannot cover or paper over a NOT MET requirement
|
|
Eligible Practices
|
Only 1-point practices (up to 22 maximum)
|
Applies broadly to operational improvements and enhancements
|
|
Score Threshold
|
Must score 80% or higher (88/110 practices MET)
|
No scoring threshold — exists independently of assessment
|
|
Close-Out
|
Formal close-out assessment by C3PAO within 180 days
|
Reviewed and updated as part of continuous monitoring; no formal close-out
|
|
Failure Consequence
|
Loses conditional certification if not remediated within 180 days
|
No direct certification consequence; may become findings in future assessments
|
|
Nature
|
Reactive — addresses deficiencies found during assessment
|
Proactive — addresses planned improvements and ongoing risk management
|
What Must a POA&M and an OPA Include to Pass a CMMC Assessment?
Knowing the difference between a POA&M and an OPA is only the first step. Organizations must also understand what each document needs to contain to satisfy assessor expectations and regulatory requirements. A strong POA&M goes beyond acknowledging a gap. It must include defined remediation steps, responsible parties, resource and budget requirements, milestones with specific dates and a firm 180-day closure commitment. A strong OPA must clearly identify the temporary vulnerability, describe the mitigation or correction plan, outline the current risk posture and explain the monitoring approach.
The table below breaks down the required content elements for each document type.
|
Strong POA&M Must Include
|
Strong OPA Must Include
|
|---|---|
|
|
8 of the Most Common POA&M and OPA Mistakes Under CMMC
Even organizations with mature security programs frequently stumble when preparing POA&Ms and OPAs for CMMC compliance. These mistakes range from treating routine vulnerabilities as OPA items (when standard vulnerability management processes under RA.L2-3.11.3 and SI.L1-3.14.1 should apply) to submitting vague timelines that assessors will immediately flag. Other common errors include omitting required mitigation details from OPAs, resubmitting pre-CMMC implementation plans as POA&Ms, assuming compliance without completing a gap assessment or collecting actual evidence, making CUI scoping errors, practices not eligible for the POA&M and preparing for the wrong assessment criteria entirely.
The table below outlines eight of the most frequent mistakes and explains why each one matters.
| # | Mistake | Why It Matters |
|---|---|---|
|
1
|
Treating routine vulnerabilities as OPA items
|
Not every vulnerability warrants an OPA. Use standard vulnerability management (RA.L2-3.11.3 / SI.L1-3.14.1) instead.
|
|
2
|
Using vague timelines in POA&Ms
|
Assessors expect specific dates, resources and checkpoints - not general language.
|
|
3
|
Leaving mitigation details out of the OPA
|
CA.L2-3.12.2 requires documenting how deficiencies will be mitigated, corrected or eliminated.
|
|
4
|
Resubmitting the NIST SP 800-171 implementation POA&M
|
A pre-CMMC project plan is not a POA&M for assessment findings; these are distinct documents.
|
|
5
|
Assumed compliance without evidence
|
Organizations often assume compliance without completing a gap assessment or actual evidence collection.
|
|
6
|
CUI scoping errors
|
Organizations fail to understand FCI and/or CUI contracts and flows in their environment.
|
|
7
|
Preparing for the wrong assessment criteria
|
Failing to identify FCI for Level 1 or CUI for Level 2 compliance.
|
|
8
|
Practices not eligible for POA&M inclusion
|
Not POA&M eligible practices and objectives will lead to failure self-assessment and C3PAO assessment.
|
How Can Organizations Avoid POA&M and OPA Failures During CMMC Certification?
Knowing what belongs in a POA&M versus an OPA is the first step. Building them with the specificity, evidence and structure that will hold up under a C3PAO assessment is the harder one. GuidePoint Security CMMC Readiness Assessment and Advisory Services can help your organizations at every stage of the CMMC journey, from scoping and gap assessments through documentation, remediation and assessment readiness. Organizations that go through the process walk into their assessment with clean documentation, defensible evidence and a clear understanding of where they stand.
FAQs
What happens if a POA&M is not closed within 180 days?
The organization loses its conditional CMMC certification status. The C3PAO must verify closure before final certification is granted. There is no extension process.
When should an organization use an OPA instead of standard vulnerability management?
An OPA applies when a temporary deficiency falls outside routine patching or scanning cycles. Standard vulnerability management under RA.L2-3.11.3 handles known, recurring issues. Use an OPA for gaps that need a documented mitigation plan.
Why do organizations fail POA&M reviews during CMMC assessments?
Most failures stem from documentation gaps, not security gaps. Organizations submit vague timelines, omit mitigation details or reuse pre-CMMC implementation plans. Assessors expect specific dates, responsible parties and evidence of progress.
Do subcontractors need their own POA&M for CMMC?
Yes. Each organization seeking CMMC certification must maintain its own POA&M. Subcontractors cannot rely on a prime contractor’s documentation.
What happens if a vulnerability is found after a CMMC assessment?
Post-assessment vulnerabilities are tracked through an OPA, not a POA&M. The OPA documents the issue and mitigation plan without triggering a new assessment cycle.
Senior Security Consultant, Compliance
GuidePoint Security
Jason Spencer is a Cybersecurity Consultant with more than a decade of experience in security assessments, compliance and risk management. Since beginning his cybersecurity career in 2010, he has specialized in network security, wireless security, vulnerability management and regulatory compliance assessments across commercial, banking and federal environments.
Jason has extensive experience conducting NIST 800-171 and CMMC assessments, having led and participated in more than 100 assessments since 2017. He is a Certified CMMC Professional (CCP) and also supports organizations with NIST 800-53, HITRUST, DFARS, HIPAA and PCI compliance initiatives. Additionally, Jason has served as a Qualified Security Assessor (QSA) since 2019 and is trained on PCI DSS 3.2.1 and 4.0.1.
His technical expertise includes perimeter, network, wireless and firewall security assessments, database auditing, workstation reviews, social engineering and security operations support within both Network Operations Center (NOC) and Security Operations Center (SOC) environments.
Jason holds a Bachelor of Arts degree in Geology with teacher certification and maintains several industry certifications, including CISSP. He has also presented at Converge in Anaheim, California.
Search
Categories
Recent Posts
Introducing the GuidePoint Security Partner Portal
November 6, 2026
Post-Quantum Cryptography Part 2: 2030 Is Not the Deadline
November 5, 2026