If a software producer could not attest to every practice, M-22-18 let an agency still use the software when the producer named the gaps, described mitigations and supplied a plan of action and milestones. M-23-16 added a condition: the agency had to seek an OMB extension and attach that plan.
The original rule in M-22-18
M-22-18 said that if a producer could not attest to one or more practices on the standard form, the agency should require the producer to do three things:
- Identify the practices it could not attest to.
- Document the practices it had in place to mitigate those risks.
- Develop a plan of action and milestones, a POA&M.
The memo told agencies to make sure this documentation was not posted publicly, by the vendor or by the agency. If the agency found it satisfactory, it could use the software despite an incomplete attestation.
The change in M-23-16
M-23-16 kept the three steps and added a gate. If the agency finds the documentation satisfactory, it "must concurrently seek an extension of the deadline for attestation from OMB," and the extension request must include a copy of the producer's POA&M.
Use had to stop in three cases: the agency found the documentation unsatisfactory, the agency could not confirm the producer had completed the three steps, or the agency failed to submit the extension request. In the memo's words, without the extension request the POA&M "is not considered valid."
OMB also said it would prioritize extension requests when many agencies shared a common POA&M, and might name a lead agency to coordinate updates. It said it would begin collecting metrics on products that did not meet the minimum requirements within a year of the memo.
What a useful POA&M looked like
The memos did not give a template, so these are general good habits rather than a required format.
- Name each gap against the specific form item, not a vague area.
- Give a date and an owner for each fix.
- Describe the compensating control that applies today.
- Update it when a date moves, and tell the agency.
A POA&M that reads like a project plan is easier for an agency to accept than one that reads like an apology.
What happens to this approach now
M-26-05 rescinded both memos, so there is no government-wide extension process driven by them. An agency that still uses the form may handle gaps its own way. The habit of listing gaps with owners and dates is still how most buyers prefer to hear about shortfalls.
CMMC uses its own POA&M rules, which are different. See CMMC POA&M rules if that is the program you mean.
Quick check
Could the POA&M be shared publicly?
The memo said agencies should ensure the documentation is not posted publicly by the vendor or by the agency.
Is the extension process still in force?
It was part of M-22-18 and M-23-16, which M-26-05 rescinded.
Sources
Last reviewed: 19 October 2026.
