A POA&M (Plan of Action & Milestones) documents which NIST SP 800-171 controls you haven't fully implemented yet and your plan to close them. Every control on your POA&M is actively deducting from your SPRS score, which starts at a perfect 110 and can drop as low as -203. Understanding how the two connect is the difference between a POA&M that's a credible roadmap and one that's just a list of excuses.

How the SPRS Score Actually Works

You start at 110 points and lose points for every control you haven't fully implemented. Each of the 110 NIST SP 800-171 controls is worth 1, 3, or 5 points, weighted by its security impact, and there's no partial credit except for two specific controls (multifactor authentication and FIPS-validated cryptography). About 15 controls are worth 5 points each, which means implementing just those could swing your score by up to 75 points, the single highest-leverage move most contractors can make.

Reference point: the average SPRS score across the Defense Industrial Base sits around -12, well below what most primes expect. If that number surprises you, you're not alone; a lot of manufacturers assume they're closer to compliant than their actual score reflects.

What Counts as a "Good" Score

88 out of 110: the minimum threshold for Conditional Level 2 status under 32 CFR ยง 170.21. Note this is 80% of 110 points, not a score of 80, a common and costly misreading.

70+: many prime contractors expect subcontractors to hit this floor even outside formal certification; a score below it may require explanation.

110: Full compliance. This remains the goal even while third-party verification is paused.

The POA&M Safety Net, and What It Can't Cover

A POA&M lets you reach Conditional Level 2 status at 88 points or higher, with 180 days from your Final Findings briefing to close the remaining gaps. But there's a hard limit: all 3-point and 5-point controls (with one narrow exception for partially-met encryption) must be fully implemented and cannot go on a POA&M at all. You can't defer your way past the controls that matter most, no matter how good your overall score looks.

What Makes a POA&M Credible vs. Wishful Thinking

Assessors are trained to tell the difference. A weak POA&M item states a vague goal with a far-off date: "Implement MFA by Q3 2026." A credible one names the specific tool, the specific scope, and measurable interim milestones: "MFA implementation for CUI boundary systems using [specific platform], phase 1 complete by [date], full rollout by [date]." Vague POA&Ms are one of the most common reasons remediation plans get flagged during review.

How Your SSP and POA&M Work Together

Your System Security Plan (SSP) describes how you implement each of the 110 controls today. Your POA&M picks up exactly where the SSP leaves off, documenting what's not yet fully implemented and your plan to get there. Assessors expect these two documents to align; a POA&M that contradicts your SSP, or an SSP with no matching POA&M for known gaps, is a red flag before the assessment even starts.

What This Means While CMMC Phase 2 Is Paused

Third-party (C3PAO) verification of your SPRS score is currently suspended following the Department of War's July 13, 2026 pause. That doesn't mean your score doesn't matter. Contracting officers can still see it, primes evaluate subcontractor risk against it regardless of certification status, and your Affirming Official's annual attestation carries real legal exposure under the False Claims Act if it's inaccurate. Right now, an honest, accurate score is your primary protection, since it's the number that matters most until third-party checks return.

Why Manufacturers Work With Justice IT Consulting

  • Registered Practitioner Organization (RPO) with Certified CMMC Professionals (CCPs) and Registered Practitioners (RPs) on staff
  • We hold our own CMMC Level 2 certification
  • 4-time Top 250 MSSP in the world, 3-time Top 500 MSP in the world
  • Our team includes an Amazon Best-Selling Author on CMMC compliance and hosts The CMMC Compliance Guide Podcast
  • Family-owned, DFW-based, 60+ five-star Google reviews

Not sure what your actual SPRS score is, or whether your POA&M would hold up under review? Contact Justice IT Consulting for an honest assessment.