A Plan of Action and Milestones (POA&M) lists the security requirements you have not met yet and how you will close them. Under CMMC, it is not a place to leave gaps open. 32 CFR 170.21 limits what can go on it and how long it can stay.

Level 1: no POA&M

A POA&M is not permitted at any time for a CMMC Level 1 self-assessment. Every one of the 15 requirements must be met.

Level 2: three conditions

You can reach a Conditional Level 2 status with a POA&M only if all of these are true:

Your assessment score divided by 110 is at least 0.8. That means a score of at least 88.- No requirement on the POA&M is worth more than 1 point under the CMMC scoring method.…