Understanding that changes are critical in any production environment, a DoD contractor has instituted measures to manage them. All software changes…

A Plan of Action and Milestones (POA&M) is a document used to track and manage the remediation of identified security deficiencies. It is created after an assessment determines that a control or practice has not been met. Therefore, a POA&M is evidence of a known gap or non-compliance, not evidence that a measure has been successfully implemented. To determine if the contractor has implemented the required measures for CM.L2-3.4.5, an assessor would examine documents that prove the control is in place and functioning, such as policies, procedures, and system configurations, not a plan to fix something that is broken.

A. Procedures addressing access restrictions for changes to the system: This is incorrect because procedures are a primary form of evidence, detailing the step-by-step methods used to enforce the access restrictions described in the policy.

C. Contractor's configuration management policy: This is incorrect because the policy is the foundational document that establishes the organization's official requirements and intent for restricting access for system changes.

D. System architecture and configuration documentation: This is incorrect because this documentation provides objective, technical evidence of how the logical and physical access controls are implemented and configured within the IT environment.

---

1. Cybersecurity Maturity Model Certification (CMMC) Model Version 2.0, Level 2 Assessment Guide, January 2023.

Reference: Page 71, for practice CM.2.069 (which corresponds to the legacy CM.L2-3.4.5). The guide lists potential assessment objects to be examined, including "Policies," "Procedures," "System security plan," and "System design documentation." It does not list the POA&M as an object for verifying a practice is "Met."

2. NIST Special Publication 800-53 Revision 5, Security and Privacy Controls for Information Systems and Organizations, September 2020.

Reference: Page 178, Control CM-5 "Access Restrictions for Change." The assessment procedures for this control family inherently require the examination of policies, procedures, and system settings that enforce access restrictions, confirming the relevance of options A, C, and D.

3. CMMC Assessment Process (CAP) for CMMC Level 2, Version 1.0, December 2022.

Reference: Section 4.3, "Conduct Assessment." This section describes the process of collecting objective evidence to determine if a practice is "Met" or "Not Met." Section 5.2, "Final Findings," clarifies that a POA&M is relevant for practices scored as "Not Met," confirming it is a post-finding artifact, not initial evidence of compliance.