Understanding the difference between a Plan of Action & Milestones (POA&M) and an Operational Plan of Action (OPA) starts with recognizing that these two documents serve different purposes under 32 CFR Part 170 (the CMMC Program). 

Knowing what belongs in a POA&M versus an OPA is the first step. Building them with the specificity, evidence and structure that will hold up under a C3PAO assessment is the harder one. GuidePoint Security CMMC Readiness Assessment and Advisory Services can help your organizations at every stage of the CMMC journey, from scoping and gap assessments through documentation, remediation and assessment readiness. Organizations that go through the process walk into their assessment with clean documentation, defensible evidence and a clear understanding of where they stand.

Jason Spencer is a Cybersecurity Consultant with more than a decade of experience in security assessments, compliance and risk management. Since beginning his cybersecurity career in 2010, he has specialized in network security, wireless security, vulnerability management and regulatory compliance assessments across commercial, banking and federal environments. Jason has extensive experience conducting NIST 800-171 and CMMC assessments, having led and participated in more than 100 assessments since 2017. He is a Certified CMMC Professional (CCP) and also supports organizations with NIST 800-53, HITRUST, DFARS, HIPAA and PCI compliance initiatives. Additionally, Jason has served as a Qualified Security Assessor (QSA) since 2019 and is trained on PCI DSS 3.2.1 and 4.0.1. His technical expertise includes perimeter, network, wireless and firewall security assessments, database auditing, workstation reviews, social engineering and security operations support within both Network Operations Center (NOC) and Security Operations Center (SOC) environments. Jason holds a Bachelor of Arts degree in Geology with teacher certification and maintains several industry certifications, including CISSP. He has also presented at Converge in Anaheim, California.