CMMC POA&M Rules and Conditional Status Explained
By Shaheer Malik · Updated Oct 28, 2026
A Plan of Action and Milestones (POA&M) lets you pass a CMMC Level 2 or Level 3 assessment with a Conditional status while a few requirements are still open, but only if you score at least 80 percent and the open items are eligible. You then have 180 days from the CMMC Status Date to close them out, or the Conditional status expires. Level 1 allows no POA&M.[1]
The Level 2 conditions
- Your score divided by the number of Level 2 requirements is at least 0.8.[1]
- No item on the POA&M is worth more than 1 point, except SC.L2-3.13.11 CUI Encryption when encryption is used but isn’t FIPS-validated.[1]
- None of these are on it: AC.L2-3.1.20 External Connections, AC.L2-3.1.22 Control Public Information, CA.L2-3.12.4 System Security Plan, PE.L2-3.10.3 Escort Visitors, PE.L2-3.10.4 Physical Access Logs, PE.L2-3.10.5 Manage Physical Access.[1]
So without a System Security Plan you cannot pass at all: it is one of the requirements that can never be deferred.
The Level 3 conditions
At least 80 percent, and the POA&M may not include the security operations center, the incident response team, threat-informed risk assessment, the supply chain risk response and plan, the security solution rationale, or specialized asset security.[1]
The 180-day closeout
A POA&M closeout assessment checks only the items left open, within 180 days of the Conditional status date. You do it yourself for Level 2 (Self); a C3PAO does it for Level 2 (C3PAO); DCMA DIBCAC for Level 3.[1] An affirmation follows.[1]
What is the CMMC Status Date?
The date the results are submitted to SPRS or the CMMC eMASS. After a successful closeout, the Conditional status date remains the status date: “A new date is not set for a Final that follows a Conditional.”[1] Your three years run from it.
Is a POA&M allowed in the contract?
Yes: contracting officers may award with a Conditional Level 2 or Level 3, for up to 180 days from the status date; Level 1 needs a Final status.[2] Federal News Network reports the reform task force suggested extending POA&M time to 270 days, which would require rulemaking.[3]
Compare CMMC consultants (RPOs) and C3PAOs by state, or describe your project once and we send it to up to 3 matching firms.
FAQ
How long is a CMMC Conditional status valid?
Up to 180 days from the Conditional CMMC Status Date. If the POA&M is not closed out within that time, the Conditional status expires.
Can the SSP be on a CMMC POA&M?
No. CA.L2-3.12.4 System Security Plan is one of six Level 2 requirements that can never be included on a POA&M.
Is a POA&M allowed for CMMC Level 1?
No. Level 1 requires every requirement to be MET; a POA&M is never permitted.
What score do I need for a Conditional CMMC status?
At least 80 percent of the maximum score (88 of 110 at Level 2), with only eligible 1-point items (or non-FIPS encryption) on the POA&M.
Sources
- 32 CFR part 170, CMMC Program (eCFR, current text) (checked Oct 28, 2026)
- Class Deviation 2026-O0025, Revision 3, Attachment 1: revised DFARS part 240 (Sep 3, 2026) (checked Oct 28, 2026)
- Federal News Network: RFI offers path forward for DoD with CMMC (Jason Miller, Oct 27, 2026) (checked Oct 28, 2026)
More on getting certified
- CMMC Certification Cost: What Level 2 Costs in 2026
- CMMC Level 2 Assessment: How a C3PAO Certifies You
- How to Get CMMC Certified: 9 Steps for 2026
- How Long Does CMMC Certification Take?
- What Defines the Scope of a CMMC Assessment?
- How to Maintain CMMC Compliance After Certification
Get quotes from matching firms
Describe what you need once. It goes to up to 3 matching firms, never published or sold.
Request quotesIndependent directory. Not affiliated with, endorsed by, or acting on behalf of The Cyber AB, the DoD, or any listed firm. Credential status can change; confirm on the Cyber AB Marketplace.