CMMC Navigatorby Foxx Cyber Bedrock CMMC

↑↓ to move, Enter to open, Esc to close. Try 3.5.3, AC.L2-3.1.1, MFA or unmarked.

3.12.2Write and work a POA&M in Rev. 3

Reworded: 03.12.02 Plan of Action and Milestones.

Status as of 2026-09-08

Rev. 2 is what a contract requires today. DFARS 252.204-7012 and the CMMC rule at 32 CFR 170 point at NIST SP 800-171 Rev. 2, and a standing DoD class deviation keeps it there. NIST has published Rev. 3, but publishing a revision does not change an obligation. A move to Rev. 3 would arrive through the Department's reform process and formal rulemaking, a change to that deviation or an amendment to the rule, not through publication. The Department has published its organization-defined parameter values for Rev. 3 in preparation; that is groundwork, not adoption.

Side by side

Rev. 2 · in force 3.12.2 Plan of Action

Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems.

Assessment objectives · 800-171A

  1. [a] plans of action are developed to address deficiencies and reduce or eliminate vulnerabilities in organizational systems
  2. [b] plans of action are implemented to address deficiencies and reduce or eliminate vulnerabilities in organizational systems

Rev. 3 · not adopted 03.12.02 Plan of Action and Milestones

a. Develop a plan of action and milestones for the system:

01. To document the planned remediation actions to correct weaknesses or deficiencies noted during security assessments and

02. To reduce or eliminate known system vulnerabilities.

b. Update the existing plan of action and milestones based on the findings from:

01. Security assessments,

02. Audits or reviews, and

03. Continuous monitoring activities.

Determination statements · 800-171A Rev. 3

  1. 03.12.02.a.01 a plan of action and milestones for the system is developed to document the planned remediation actions for correcting weaknesses or deficiencies noted during security assessments.
  2. 03.12.02.a.02 a plan of action and milestones for the system is developed to reduce or eliminate known system vulnerabilities.
  3. 03.12.02.b.01 the existing plan of action and milestones is updated based on the findings from security assessments.
  4. 03.12.02.b.02 the existing plan of action and milestones is updated based on the findings from audits or reviews.
  5. 03.12.02.b.03 the existing plan of action and milestones is updated based on the findings from continuous monitoring activities.

Draws on Rev. 2 3.12.2.

Left: NIST SP 800-171 Rev. 2 and 800-171A, verbatim. Right: NIST SP 800-171 Rev. 3 and 800-171A Rev. 3, verbatim, with organization-defined blanks highlighted.

Word by word

The Rev. 2 requirement compared with its Rev. 3 successor. A mechanical comparison of the two verbatim texts, not an interpretation.

removed in Rev. 3 added in Rev. 3

Rev. 2 3.12.2 → Rev. 3 03.12.02 Plan of Action and Milestones

Develop and implement plans a plan of action designed and milestones for the system: To document the planned remediation actions to correct weaknesses or deficiencies noted during security assessments and To reduce or eliminate known system vulnerabilities. in organizational systems. Update the existing plan of action and milestones based on the findings from: Security assessments, Audits or reviews, and Continuous monitoring activities.

11 words kept, 7 removed, 44 added. Rev. 3 statement labels omitted for the comparison.

What NIST says changed

  • New security requirement title
  • Aligned with SP 800-53, Rev 5 to provide more comprehensive detail on and foundational tasks for developing and maintaining a plan of action and milestones

NIST, SP 800-171 Rev. 2 to Rev. 3 change analysis, class “Significant change”. At adoption, Bedrock files this under “Rework”.

NIST's Rev. 3 discussion for 03.12.02

Plans of action and milestones (POAMs) are important documents in organizational security programs. Organizations use POAMs to describe how unsatisfied security requirements will be met and how planned mitigations will be implemented. Organizations can document system security plans and POAMs as separate or combined documents in any format. Federal agencies may consider system security plans and POAMs as inputs to risk-based decisions on whether to process, store, or transmit CUI on a system hosted by a nonfederal organization.

What this means for you now

Nothing changes in what you are assessed against until a class deviation or a published rule adopts Rev. 3. Keep meeting 3.12.2 as written in Rev. 2.

Bedrock CMMC shows this same comparison against your own package, with your current status on the Rev. 2 side, so the day adoption lands the migration is a review, not a rewrite.

Back to the Rev. 2 vs Rev. 3 overview

Where this page's facts come from
Rev. 2 text and objectives
bedrock-cmmc-api@89b8e8e:migrations/004_reference_requirements.sql#Requirement.basicRequirement@rev2; bedrock-cmmc-api@89b8e8e:migrations/005_reference_objectives.sql#AssessmentObjective.description@rev2
Mapping and change class
bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/r2_r3_transition_map.json#r2_to_r3
Rev. 3 03.12.02
bedrock-cmmc-api@89b8e8e:docs/reference/nist-800-171-rev3/normalized/rev3.json#requirements[]