CMMC POA&M Rules: What Can Wait 180 Days and What Can't

Published October 5, 2026

A CMMC Level 2 self-assessment with gaps is not automatically a failure. Some gaps can go on a Plan of Action and Milestones (POA&M) and be fixed within 180 days, which gives you a Conditional status in the meantime. But the rules on what can wait are strict, and a few requirements can never wait at all.

Level 1: no POA&M at all

A POA&M is not permitted at any time for a Level 1 self-assessment. (Source: 32 CFR 170.21, plan of action and milestones requirements, (a)(1).) Level 1 requirements must be fully implemented and are scored as MET or NOT MET in their entirety. (Source: 32 CFR 170.24, CMMC scoring methodology, (c)(1).)

Level 2: three conditions, all required

You can reach Conditional Level 2 (Self) only if all three of these hold: (Source: 32 CFR 170.21, plan of action and milestones requirements, (a)(2).)

1. The score is at least 80 percent of the maximum. The rule says the score divided by the number of Level 2 requirements must be greater than or equal to 0.8. With 110 requirements, that is a score of 88 or more.
2. Only 1-point requirements go on the POA&M, with one exception: 3.13.11 (CUI encryption) may be included if encryption is used but is not FIPS-validated, which is worth 3 points.
3. None of the six excluded requirements is on it (the list below).

The threshold is not enough on its own. A score of 98 that includes a 5-point gap still cannot go Conditional, because that gap cannot sit on a POA&M. For how the score itself is worked out, see the SPRS score math.

What can never go on a POA&M

These six requirements are excluded by name, whatever their point value: (Source: 32 CFR 170.21, plan of action and milestones requirements, (a)(2)(iii).)

• AC.L2-3.1.20, external connections (CUI data)
• AC.L2-3.1.22, control public information (CUI data)
• CA.L2-3.12.4, system security plan
• PE.L2-3.10.3, escort visitors (CUI data)
• PE.L2-3.10.4, physical access logs (CUI data)
• PE.L2-3.10.5, manage physical access (CUI data)

Add to that every requirement worth 5 or 3 points, other than the 3.13.11 encryption exception, since condition 2 rules them out. So in practice the POA&M can hold 1-point items not on the list above, and 3.13.11 when the only problem is FIPS validation.

Being on a POA&M does not make a requirement met. A requirement that is not implemented is scored NOT MET, POA&M or not. (Source: 32 CFR 170.24, CMMC scoring methodology, (c)(2)(i)(B)(6).)

The 180-day closeout

Closing the POA&M takes a closeout assessment that looks only at the NOT MET requirements that were on the POA&M. It must be confirmed within 180 days of the Conditional CMMC Status Date. (Source: 32 CFR 170.21, plan of action and milestones requirements, (b).) For a Level 2 self-assessment, you perform the closeout yourself, in the same manner as the original self-assessment. (Source: 32 CFR 170.21, plan of action and milestones requirements, (b)(1).) You must remediate the gaps, perform the closeout self-assessment and post the results to SPRS within those 180 days. (Source: 32 CFR 170.16, CMMC Level 2 self-assessment and affirmation requirements, (a)(1)(ii)(B).)

What happens on day 181

If the POA&M is not closed out within 180 days, the Conditional status expires. If it expires during the period of performance of a contract, "standard contractual remedies will apply," and you are ineligible for additional awards that require Level 2 (Self) or higher for that system until you achieve a new CMMC status. (Source: 32 CFR 170.16, CMMC Level 2 self-assessment and affirmation requirements, (a)(1)(ii)(B).) A successful closeout moves you to Final Level 2 (Self). (Source: 32 CFR 170.16, CMMC Level 2 self-assessment and affirmation requirements, (a)(1)(iii).)

Before award of a contract that requires Level 2 (Self), you need either a Conditional or a Final status, plus an affirmation in SPRS. (Source: 32 CFR 170.16, CMMC Level 2 self-assessment and affirmation requirements, (b).)