Closure Evidence

Closure evidence is documentation demonstrating that a POA&M item has been fully resolved and the underlying NIST SP 800-171 requirement is now met. It is required to close a POA&M item before the 180-day deadline imposed by CMMC 2.0.

Acceptable closure evidence varies by requirement type. For technical requirements, it might include configuration screenshots, change tickets, scan results showing the issue resolved, and test results. For policy or procedural requirements, it might include the updated policy document, training records, and a sample of the procedure being followed in practice.