Can I use a Plan of Action & Milestones (POA&M) for CMMC Level 1?
Last updated: 6/5/2025
For CMMC Level 1, all 15 requirements must be assessed as 'MET' or 'N/A' at the time of the self-assessment for a passing SPRS score. Unlike some previous interpretations of self-attestation, POA&Ms are generally not accepted for unmet Level 1 controls for the purpose of achieving compliance. Temporary deficiencies may be addressed in an operational plan of action, but this has specific criteria.