What Is the Difference Between an Operational Plan of Action (OPA) and a POA&M?

OPA vs POA&M: Two Different Documents

These are frequently confused but serve very different purposes in the CMMC ecosystem.

Plan of Action and Milestones (POA&M)

• Purpose: Documents unmet CMMC requirements at assessment time
• When used: During and after a CMMC assessment
• Timeline: Must be closed within 180 days
• Consequence: Failure to close = loss of CMMC status
• Scope: Only for non-critical requirements

Operational Plan of Action (OPA)

• Purpose: Documents ongoing operational risks and mitigations
• When used: Continuously during normal business operations
• Timeline: Ongoing — no fixed deadline
• Consequence: Part of good security practice, tracked in your risk management process
• Scope: Any identified risk, not limited to CMMC requirements

Key Distinction

The OPA is part of your continuous risk management process under CA.L2-3.12.2. It tracks things like planned system upgrades, temporary vulnerabilities during maintenance windows, and known risks with accepted mitigations. The POA&M is a CMMC-specific compliance document with hard deadlines and consequences for non-completion.