POA&M rules for CMMC Level 2: what can wait and for how long

A CMMC Level 2 plan of action and milestones (POA&M) lets a company hold a Conditional CMMC status while it finishes a few requirements. Under 32 CFR 170.21, that is allowed only when the SPRS score is at least 88 of 110, every requirement on the plan is worth 1 point (3.13.11 may be on it at 3 points), none of six named requirements is on it, and the plan is closed out within 180 days of the Conditional CMMC Status Date. Miss any of those and there is no Conditional status.

This guide explains the rules as of October 21, 2026. It is not legal advice: the clauses in your contract decide what applies to you.

What a POA&M is for in CMMC

32 CFR 170.21(a) opens with the purpose: "For purposes of achieving a Conditional CMMC Status, an OSA is only permitted to have a POA&M for select requirements scored as NOT MET during the CMMC assessment and only under the following conditions". OSA is the regulation's term for the organization seeking assessment. Two things a POA&M does not do:

• It does not raise the score. Under 32 CFR 170.24(c)(2)(i)(B)(6), "A POA&M addressing NOT MET security requirements is not a substitute for a completed requirement", and a requirement "whether described in a POA&M or not, is assessed as 'NOT MET.'" The SPRS score guide covers the arithmetic.
• It is not available at Level 1. Under 170.21(a)(1), "A POA&M is not permitted at any time for Level 1 self-assessments."

The 88-point threshold

Under 170.21(a)(2)(i), the first condition for Conditional Level 2 (Self) or Conditional Level 2 (C3PAO) is that "the assessment score divided by the total number of CMMC Level 2 security requirements is greater than or equal to 0.8". There are 110 requirements, and 0.8 times 110 is 88. The free SPRS score calculator shows your score against that floor as you answer, and names any gap no POA&M may hold.

The floor caps how much can be open: 110 minus 88 is 22 points, so at most 22 one-point requirements, or 3.13.11 at 3 points plus up to 19 of them.

Which NIST 800-171 requirements can be on a POA&M?

Under 170.21(a)(2)(ii), "None of the security requirements included in the POA&M have a point value of greater than 1 as specified in the CMMC Scoring Methodology set forth in 170.24, except SC.L2-3.13.11 CUI Encryption may be included on a POA&M if encryption is employed but it is not FIPS-validated, which would result in a point value of 3".

So:

• Any 1-point requirement may be on the plan, apart from the six below. By the lists in 32 CFR 170.24, 51 requirements carry 1 point; five of them are among the six, which leaves 46.
• 3.13.11, FIPS-validated cryptography, may be on the plan only when encryption is already in place and the gap is FIPS validation. With no encryption at all it costs 5 points and cannot be on the plan.
• Every 5-point and 3-point requirement must be met. That includes 3.5.3, multifactor authentication: its partial credit (3 points when MFA covers only remote and privileged users) lowers the score, but 170.21 gives it no POA&M exception.

The six requirements that can never be on a POA&M

Under 170.21(a)(2)(iii), none of the following may be on a Level 2 POA&M, whatever the score:

Five of the six are 1-point requirements, which is why they are named: without this list the 1-point rule would let them wait. The system security plan has no point value of its own because under 170.24(c)(2)(i)(B)(5) an assessment "could not be completed" without one.

The six sit in three families, each requirement there with its objectives and how to meet it: 3.1 Access Control (3.1.20 and 3.1.22), 3.10 Physical Protection (3.10.3, 3.10.4 and 3.10.5) and 3.12 Security Assessment (3.12.4).

Conditional status: 180 days to close out

Under 170.21(b), "The closing of a POA&M must be confirmed by a POA&M closeout assessment within 180-days of the Conditional CMMC Status Date. If the POA&M is not successfully closed out within the 180-day timeframe, the Conditional CMMC Status for the information system will expire."

A closeout assessment "assesses only the NOT MET requirements that were identified with POA&M in the initial assessment". For a self-assessment the company performs it "in the same manner as the initial self-assessment" (170.21(b)(1)); for a certification assessment, "an authorized or accredited C3PAO" does (170.21(b)(2)). 32 CFR 170.16(a)(1)(ii)(B) adds that the company "must remediate any NOT MET requirements, must perform a POA&M closeout self-assessment, and must post compliance results to SPRS within 180 days of the CMMC Status Date".

What expiry costs is in the same paragraph: "standard contractual remedies will apply, and the OSA will be ineligible for additional awards with a requirement for the CMMC Status of Level 2 (Self), or higher requirement, for the information system within the CMMC Assessment Scope until such time as a new CMMC Status is achieved."

After the closeout the status becomes Final Level 2 (Self) under 170.16(a)(1)(iii), and 32 CFR 170.22(a)(3)(iv) requires the Affirming Official to submit a new affirmation in SPRS "following a POA&M closeout assessment".

A temporary deficiency is not a POA&M item

Under 170.24(b)(1)(ii), "Temporary deficiencies that are appropriately addressed in operational plans of action (i.e., include deficiency reviews and show progress towards the implementation of corrections to reduce or eliminate identified vulnerabilities) shall be assessed as MET." The methodology's example is a patch that invalidates the FIPS validation of a module already implemented. Such a requirement is Met and is not on the 170.21 POA&M. A requirement never fully implemented is Not Met; the methodology says an MFA roll-out "only 75% complete" is still not implemented.

A POA&M template for NIST 800-171

32 CFR 170.21 does not prescribe a form. The methodology says a plan of action is kept "for each unimplemented security requirement to describe how and when the security requirement will be met", and that a missing plan makes requirement 3.12.2 itself "not implemented". SPRS asks for one date per system security plan, the plan of action completion date, which the methodology's SPRS entry instructions define as the "date that a score of 110 is expected to be achieved for each system security plan assessed". A workable minimum per open requirement:

1. The requirement number, and whether 170.21 allows it on the plan.
2. The weakness: which NIST SP 800-171A assessment objective is not met.
3. The planned fix, in enough detail that someone else could carry it out.
4. The planned completion date, inside the 180-day window.
5. Milestones with dates, and whether each is done, so the plan shows progress.
6. The owner, and where the evidence will be when the fix lands.

Keep the closed items: the closeout self-assessment covers exactly the requirements that were on the plan, and under 170.16(c)(4) assessment artifacts are kept for six years.

Checklist before you claim Conditional Level 2 (Self)

• Score of 88 or more by the 32 CFR 170.24 method.
• Every open requirement is worth 1 point, or is 3.13.11 with encryption in place but not FIPS-validated.
• None of 3.1.20, 3.1.22, 3.10.3, 3.10.4, 3.10.5 or 3.12.4 is open.
• Each open requirement has a plan with a completion date inside 180 days of the Conditional CMMC Status Date.
• The score, date, scope and plan of action completion date are posted in SPRS, and the Affirming Official has affirmed.

For where the CMMC rollout stands, see the guide on CMMC Phase 2, and DFARS and FAR cyber clauses for the clauses that carry these rules.

Where Tiermark fits

With Supplier Pro, every requirement in the Tiermark self-assessment workspace has a plan of action with a weakness, a planned fix, a planned completion date and milestones, and one line saying what 32 CFR 170.21 makes of the requirement: allowed on a POA&M, allowed only when partly met (3.13.11), or never allowed. The SPRS score calculator says whether your answers would support a Conditional status and lists any gap that cannot wait. Compliance dates takes your Conditional status date, shows the 180-day closeout deadline, and emails your admins 60, 30 and 7 days before it. Tiermark records what you enter, does not assess it, and posts nothing to SPRS.

Conditional status, POA&M closeout, OSA and the other terms used here are defined in the glossary.

Sources

• 32 CFR 170.21, Plan of Action and Milestones requirements
• 32 CFR 170.24, CMMC Scoring Methodology
• 32 CFR 170.16, CMMC Level 2 self-assessment and affirmation requirements
• 32 CFR 170.22, Affirmation
• NIST SP 800-171 DoD Assessment Methodology, Version 1.2.1, June 24, 2020 (PDF)
• SPRS: NIST SP 800-171 Assessments