The GRC to-do list

From POA&Ms to ConMon, learn how to track the work your compliance program requires.

Join Steven Molter and Jeremy Lyles for a practical session on Cybersecurity Maturity Model Certification (CMMC) and NIST SP 800-171 programs. See how IntelliGRC Action Plans and Continuous Monitoring turn remediation, recurring activities, and evidence requests into tracked, auditable work.

Steven Molter

Lead GRC Consultant

Jeremy Lyles

Functional Lead

Your governance, risk, and compliance (GRC) program includes several kinds of work. This session separates those categories, then brings them together in a live IntelliGRC workshop.

• Distinguish your POA&Ms: Understand the difference between initial implementation and post-assessment Plans of Action and Milestones (POA&Ms).
• Identify operational POAs: Learn what qualifies as an operational Plan of Action under NIST SP 800-171 Rev. 2 practice 3.12.2.
• Organize continuous monitoring: Explore ongoing monitoring activities and how to determine their cadence.
• Plan evidence gathering: Track the evidence requests you need for internal assessment preparation.
• Put the work into practice: See how to build, assign, and track action items with IntelliGRC Action Plans and Continuous Monitoring (ConMon).

When is the live webinar?

The webinar takes place on November 5, 2026, from 2–3 p.m. Eastern Time. Steven Molter and Jeremy Lyles will cover the categories of work in a GRC program, then demonstrate how to track those activities in the IntelliGRC platform.

Will I see the IntelliGRC platform in action?

Yes. The session includes a live workshop inside IntelliGRC. You will see how Action Plans support building, assigning, and tracking compliance work, and how Continuous Monitoring (ConMon) provides a system of record for ongoing activities in your GRC program.

Which compliance activities will the session cover?

The session covers initial implementation and post-assessment POA&Ms, operational Plans of Action under NIST SP 800-171 Rev. 2 practice 3.12.2, continuous monitoring activities, and evidence gathering. You will explore how those categories differ and how to track them within IntelliGRC.