Can you win a contract with Conditional CMMC status

Can you win a contract with Conditional CMMC status?

A Conditional status can win a Level 2 or Level 3 award, but Level 1 requires a Final status. Under DFARS 204.7502(b)(2), Levels 2 and 3 may be held in Conditional status for up to 180 days from the CMMC status date, and award can occur while that status is held. If a solicitation asks for Level 1, a Conditional rating does not qualify, because every Level 1 requirement must be MET and no POA&M is permitted. For Level 2, the answer depends on three checks: whether the score reached the threshold, which open requirements sit on the POA&M, and whether the 180-day window is still open. Your organization owns its controls and its score. A partner can prepare systems and evidence, but only the independent C3PAO or assessor determines status where a certification assessment applies.

The first gate is at least 88 of 110 points. Under 32 CFR 170.21(a)(2), a Level 2 assessment earns Conditional status only at that score, and each POA&M item is worth one point, with one exception: SC.L2-3.13.11 is worth less when encryption is used but is not FIPS-validated. The second gate is a list of six requirements that cannot appear on any Level 2 POA&M: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5. A missing system security plan or a visitor escort control that is not operating cannot be deferred, regardless of the overall score. Check these six first, and confirm each against the assessment objectives in NIST SP 800-171A, since a requirement counts as MET only when its evidence is in final form.

Which requirements can and cannot wait on a POA&M

A Conditional Level 2 status lets a contractor carry open requirements on a plan of action and milestones, but the rule fences off a small set of requirements that must be MET at assessment. The cards below set out that fence and the scoring rule that governs everything else, so you can check your own gaps against the text before you bid.

External connections (AC.L2-3.1.20)

This requirement covers controls over connections to systems outside your boundary, such as partner networks, cloud services and remote endpoints. The rule bars it from any Level 2 POA&M because an unverified external connection can expose CUI before a closeout date arrives. Before bidding, inventory every external connection that touches systems handling CUI and confirm each one is controlled today. Confirm the exact wording against the eCFR text.

Control of public information (AC.L2-3.1.22)

This requirement concerns controlling CUI posted or processed on publicly accessible systems, including websites and public file shares. The rule does not allow it on a POA&M, so a single public-facing location that exposes CUI can block a Conditional status outright. Review web content, public repositories and marketing material for CUI before the assessment. Confirm the scope of this requirement in the eCFR text.

System security plan (CA.L2-3.12.4)

The system security plan describes your system boundary, the controls you implement and how they work. The rule excludes it from the POA&M, which means a missing or incomplete plan cannot be deferred to a later closeout. Treat the plan as a prerequisite to scoring rather than a deliverable that follows it. Confirm the plan's required content against the eCFR text before you start drafting.

Escorting visitors (PE.L2-3.10.3)

This requirement covers escorting visitors and monitoring their activity in areas where CUI is handled. The rule bars it from a POA&M, so an unescorted visitor path to a CUI area is a disqualifying gap at assessment rather than a deferred item. Walk the facility as an assessor would and confirm that visitor procedures are written, followed and evidenced. Confirm the exact requirement wording in the eCFR text.

Physical access logs (PE.L2-3.10.4)

This requirement asks you to keep logs of physical access to facilities and systems where CUI resides. Because the rule forbids a POA&M for it, a gap in access logging cannot be closed after the Conditional status is issued. Check that logs are captured for every controlled area, retained, and reviewed. Confirm the retention and content expectations against the eCFR text.

Managing physical access (PE.L2-3.10.5)

This requirement covers managing physical access devices such as keys, badges and combinations, including how they are issued, changed and revoked. The rule bars it from a POA&M, so an unmanaged badge or shared key can prevent Conditional status regardless of the score. Inventory access devices, confirm revocation steps for departing staff, and record changes. Confirm the requirement details in the eCFR text.

Single-point POA&M and encryption exception

Each open requirement on a POA&M is worth one point, and the score must reach at least 88 of 110 points for Conditional status. The one exception is SC.L2-3.13.11, which is scored differently when encryption is used but not FIPS-validated. Count your POA&M items against the threshold before assuming a Conditional status is reachable. Confirm the scoring method in the eCFR text of 32 CFR 170.24.

How the 180-day clock and status date work

The sequence turns a Conditional result into a Final status by setting a fixed closeout window, recording a status date that anchors the assessment cycle, and requiring the contractor to show that every open item was closed. Each step ends with a record that a contracting officer or assessor can check.

Confirm the assessment scored at least 88 points
The assessor, or the contractor for a self-assessment, scores the 110 Level 2 requirements against the NIST SP 800-171A assessment objectives. A Conditional result requires a score of at least 88 of 110 points, with every open item on a plan of action and milestones (POA&M) and the six barred requirements fully MET. The output is a scored assessment record that shows which requirements sit on the POA&M, so the contractor can see exactly what must close.
Record the Conditional status and status date
Once the result qualifies, the Conditional status is entered for the organization and its CMMC UIDs, and a CMMC status date is set to the date of that Conditional status. For self-assessments, the contractor enters the result in SPRS. The output is a status record that names the date from which all later steps are measured, and that date is what contracting officers see when they review the award.
Start the 180-day closeout window
The Conditional status may be held for up to 180 days from the CMMC status date. During that window, the contractor works the POA&M items to completion and keeps evidence in final form, since drafts do not count toward closing an item. Confirm the exact deadline in your own records against the status date, because the window runs from that date and not from the date the POA&M was written. The output is a dated POA&M with each item tied to an owner and a closing artifact.
Close each POA&M item with final evidence
The contractor closes each open requirement by implementing the control and producing evidence that satisfies every applicable assessment objective. The assessor or the contractor then re-checks the affected requirements and updates the score. The output is a closeout package that shows every POA&M item is resolved and that the score now meets the Final threshold for the level.
Complete successful closeout under DFARS 252.204-7021
DFARS 252.204-7021(d)(5) requires a contractor holding a Conditional status to successfully close out a valid POA&M to reach Final status. Closeout is not automatic: the contractor must show the closed items and update the record in the system where the status is held. The output is a Final status entry that replaces the Conditional entry for the same organization and UIDs.
Keep the original status date for the cycle
Under 32 CFR 170.4, the CMMC status date stays at the date of the Conditional status after a successful closeout. The three-year assessment cycle therefore runs from the Conditional date, not from the date the Final status was reached. The output is a status date that the contractor must track for its next assessment, so the renewal deadline is set when the Conditional status is first recorded.
Plan for expiration if the window closes
If the POA&M is not closed within the 180-day window, the Conditional status expires. Under 32 CFR 170.16 and 170.17, contractual remedies then apply to any contract that depends on the status, and the contractor cannot win new awards that require it until it achieves a new status. Ask your contracting officer which remedies apply to in-progress work before the window closes. The output is a decision, made before the deadline, to either finish closeout or plan a new assessment.

What happens if Conditional status expires during a contract

If a Level 2 Conditional status is not converted to Final within 180 days, the status expires. Under 32 CFR 170.16 and 170.17, a contractor that loses its status during performance faces the standard contractual remedies in its contract, and it cannot win new awards that require that status until it achieves a new one. The expiry is therefore two problems at once: an existing contract may be in breach, and the pipeline of future work requiring Level 2 is blocked until a new assessment succeeds. The regulation sets the consequence, but the specific remedies, notice periods and cure rights come from the contract itself and from the DFARS clauses it incorporates, so the reader should not assume the outcome without reading those terms.

Start tracking the clock on the day the contract is awarded, not when the POA&M deadline approaches. Record the CMMC status date, the date the 180-day window closes, and the internal target date for closing each POA&M item. Under DFARS 252.204-7021, a contractor holding a Conditional status must close out a valid POA&M to reach Final status, so the closeout effort is a contract obligation as well as a scoring exercise. Confirm with the contracting officer which party is notified if status lapses, whether the contract includes a cure period, and how the contract treats a pending C3PAO assessment that has not yet been scheduled.

Before the first contract award, take three decisions with counsel and the contracting officer's written guidance in hand. Decide who owns the closeout calendar and who signs the affirmation if a POA&M item slips. Ask whether the contract's remedies would apply to a subcontractor whose own status lapses, since each prime and subcontractor affirms for itself. Finally, confirm how the 180-day limit interacts with the current DoW suspension of Phase II, because the status rules in the regulation and the enforcement timetable are being reviewed, and the reader should not plan around an assumption about either.

Why Level 1 has no Conditional status

Level 1 follows a different path from Level 2 because it has no Conditional tier at all. The four cards below cover the requirements, the no-POA&M rule, the award consequence, and the checks to run before anyone signs a Level 1 affirmation.

Every requirement must be met

Level 1 covers the 15 safeguarding requirements of FAR 52.204-21 for Federal contract information. Under 32 CFR 170.15 and 170.21(a)(1), all 15 must be MET before the organization can claim Final Level 1 (Self). A score close to passing does not earn a status, so a single unmet requirement blocks the whole result. Before you start, map each of the 15 requirements to a system, a person and a piece of evidence that exists today.

No plan of action permitted

Level 2 lets a contractor carry open items on a POA&M and still earn Conditional status. Level 1 does not. Under 32 CFR 170.21(a)(1), no POA&M is permitted at Level 1, so an open requirement is a failed requirement. Check each requirement for the three things an assessor would look for: a control in operation, a named owner, and evidence that is final rather than a draft.

Final status is required for award

Under DFARS 204.7502(b)(2), a Level 1 requirement needs a Final status for award, while Level 2 and Level 3 can be awarded on a Conditional status. A Level 1 contractor that is one requirement short therefore cannot use a partial result to compete. Confirm with the contracting officer which level the solicitation requires and whether the CMMC UID and status are listed in the proposal.

Check the self-assessment before signing

The Level 1 affirmation is a statement by the Affirming Official that the requirements are met, so the review should happen before signature. Confirm that each requirement has evidence in final form, that the scope covers every system and location that handles FCI, and that the SPRS Level 1 entry matches the self-assessment result. Ask whether an outside reviewer or implementation partner can test the evidence, while the organization keeps ownership of the controls and the signature.

How the answer changes by situation

When a Level 2 self-assessment scores at least 88 of 110 points and all six barred requirements are MET, the organization can reach Conditional status. Under DFARS 204.7502(b)(2), a Conditional Level 2 status can support award, so a contracting officer whose solicitation requires Level 2 may consider the offer eligible. Whether the offer is accepted depends on the solicitation language and on the affirmation that the Affirming Official signs, since both define what the contracting officer will accept.

Award outcome: Eligibility for award where the solicitation accepts Conditional status at Level 2, subject to the contracting officer's review.
Barred requirements: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5 must be MET, not carried on a POA&M.
Next action: Build a POA&M for the remaining open items and schedule its closeout inside the 180-day window.
Status date: Record the Conditional status date, since the 180-day clock and the three-year cycle both run from it.
Affirmation: Confirm the Affirming Official understands that the affirmation covers the POA&M items as well as the MET requirements.

Before submitting, check the solicitation text and the CMMC UID listed in the proposal against the SPRS entry.

What to check before you bid on a Conditional basis

A Conditional status can support award, but only if the score, the POA&M and the dates hold up under scrutiny. The checks below cover what the organization must verify before it commits to a bid, and each one ties back to a rule that can disqualify the status if it fails.

Confirm the score and POA&M against 800-171A

Recalculate the Level 2 score yourself rather than trusting a prior worksheet. The status requires at least 88 of 110 points, and every POA&M item counts as 1 point (with the single exception of SC.L2-3.13.11 when encryption is used but not FIPS-validated). Check each open item against the NIST SP 800-171A assessment objectives, and confirm that the evidence for every MET requirement is in final form, not drafts. A requirement is MET only when all applicable objectives are satisfied.

Verify the six barred requirements are fully met

Six requirements cannot appear on a Level 2 POA&M at all: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5. Each must be fully implemented with current evidence before the assessment, because a gap in any of them blocks the Conditional status regardless of the total score. Walk through external connections, public information controls, the system security plan, visitor escorts, physical access logs and physical access management with the people who run them.

Confirm encryption status for SC.L2-3.13.11

SC.L2-3.13.11 is the one item that can sit on the POA&M at a different weight, but only in a specific case: encryption is used but the module is not FIPS-validated. Confirm which cryptographic modules actually protect CUI in transit and at rest, and whether each one holds a FIPS validation. Ask the team to document the module names and validation status, because an assessor will ask for that record rather than a general statement that encryption is in place.

Set the status date and closeout deadline

A Conditional status can be held for up to 180 days from the CMMC status date, and the POA&M must close within that window or the status expires. Put the status date, the 180-day deadline and the closeout milestones for each open item into the project plan, with a named owner for each. Remember that a successful closeout keeps the original Conditional date as the status date, so the three-year cycle runs from the start, not from closeout.

Confirm the CMMC UID and SPRS entry

Confirm that the CMMC Unique Identifier (UID) tied to the assessed environment matches the one you will list in the proposal, and that the SPRS entry shows the same status, score and status date. A mismatch between the assessed system boundary and the listed UID is a common reason a proposal looks compliant on paper but fails the contracting officer's eligibility review. Check both records before submission, not after the award notice.

Confirm Phase II status and the stated level

Read the solicitation to confirm which CMMC level it requires and whether it accepts a Conditional status at award. The Department of War suspended Phase II on 13 July 2026, but Phase I self-assessments, SPRS postings and affirmations still apply. The DoW CIO "About CMMC" page and eCFR 32 CFR 170.3(e) describe the phase schedule differently, so confirm the applicable timing with the contracting officer in writing before you rely on either source.

Questions buyers ask about Conditional CMMC status

Can I bid on a DoD contract with Conditional CMMC status?

Yes, for Level 2 work, a Conditional status can support award. Under DFARS 204.7502(b)(2), Level 2 and Level 3 can be held in a Conditional status for up to 180 days from the CMMC status date, and award can occur with that status. Level 1 requires a Final status. Your CMMC UIDs and status still have to be listed as the solicitation directs. Read the level and status wording in the solicitation before you bid, because the contracting officer sets the requirement. The status itself comes from the assessment, so your proposal language cannot create it. Confirm the status you hold and its date with your assessor and your CMMC records before you submit.

Does a DoD solicitation accept a Conditional CMMC status?

A solicitation accepts a Conditional status when its stated CMMC level and clause allow it, and for Level 2 the DFARS framework permits award with that status. Under DFARS 252.204-7025, the contracting officer states which level is required and how eligibility is shown, and higher statuses satisfy lower requirements. Ask the contracting officer three things in writing: which status meets the requirement, whether a Level 2 Conditional status with an open POA&M is eligible, and how CMMC UIDs must appear in the proposal. The clause text is published on eCFR, and the solicitation governs your bid.

How long do I have to close a CMMC POA&M?

The supplied rules give you 180 days from the Conditional status date to close the POA&M. If it is not closed in that window, the Conditional status expires. If that happens during a contract, standard contractual remedies apply, and you cannot win new awards that require the status until you achieve a new one. To reach Final status, DFARS 252.204-7021(d)(5) requires a valid POA&M closeout. After a successful closeout, the status date stays the date of the Conditional status, so the three-year assessment cycle runs from that original date. Plan closeout evidence and reassessment timing as one schedule, and see 32 CFR 170.21 for the POA&M rules.

Which Level 2 requirements can wait on a POA&M?

Level 2 needs at least 88 of the 110 points to earn Conditional status, which is a ratio of 0.8. Each POA&M item is worth 1 point, with one exception for SC.L2-3.13.11 when encryption is used but not FIPS-validated. Six requirements cannot appear on a Level 2 POA&M at all, so they must be MET before award:

AC.L2-3.1.20, external connections
AC.L2-3.1.22, control of public information
CA.L2-3.12.4, the system security plan
PE.L2-3.10.3, escorting visitors
PE.L2-3.10.4, physical access logs
PE.L2-3.10.5, managing physical access

Every other gap can be carried as a POA&M item within the score limit, and the assessor confirms each item against the NIST SP 800-171A objectives.

Can a partner close my CMMC POA&M for me?

A partner can prepare systems, configure controls, produce evidence and document the work, but it cannot own the outcome. The organization owns its controls and POA&M, and its Affirming Official signs the affirmations. Only the independent assessor determines and records status. DeployOpen plans, implements, hardens and documents self-hosted open-source platforms inside your own infrastructure, and it prepares systems, controls and evidence for assessments. It does not issue reports, attestations or certificates. Ask for a written scope that names each POA&M item, the evidence each one needs, who performs the closeout, and who submits the results.

How much effort does closing a Conditional CMMC POA&M take?

No supplied figure sets the effort, so the answer depends on what is open. The main drivers are the number of POA&M items, how many points they carry, whether any item touches the six barred requirements, and how large the system boundary is. Evidence must be in final form, because drafts do not satisfy an objective. Encryption that is not FIPS-validated also counts against you. Your costs fall into internal staff time, tooling, a fixed-scope implementation partner if you use one, and assessor fees paid to the assessing body. Assessment fees are one-time per assessment, while affirmations and SPRS updates recur. Ask every quote for itemized deliverables, the evidence list, retesting, and a schedule that fits the 180-day window.

Does the Phase II suspension change Conditional CMMC status rules?

The Department of War suspended CMMC Phase II on 13 July 2026. That phase had been scheduled to start on 10 November 2026 and would have required Level 2 C3PAO certification for applicable contracts. Phase I self-assessments, SPRS postings, annual affirmations and DFARS 252.204-7012 obligations remain in place. The supplied sources do not say the 88-point threshold, the six barred requirements or the 180-day clock changed. The DoW CIO's About CMMC page, as of 17 October 2026, says implementation is paused and may only require self-assessments at Levels 1 and 2, while the eCFR text still shows the original phase schedule. Confirm the current position with the contracting officer and read the suspension notice before you plan.

How DeployOpen works on this

DeployOpen helps organizations prepare the systems, controls and evidence that a Conditional CMMC review would look at, inside the client's own infrastructure. We do not issue assessment results or status; the organization owns its controls and an independent assessor makes the determination.

How we scope

Engagements are fixed-scope, with the systems in the CUI boundary, the requirements in scope and deliverables agreed in writing before work starts.
The written scope names which Level 2 requirements are on any POA&M and which must be fully MET before submission, such as the six requirements barred from a POA&M.
We confirm the target status date and the 180-day closeout window with the client so the remediation plan matches the contract timeline.

How we build

We harden and document the self-hosted open-source platforms that handle CUI, including configuration baselines, access controls and logging inside the client's environment.
We produce the system security plan and POA&M entries in final form, with evidence mapped to each requirement ID and its assessment objectives.
We test the controls we configure, record the results and flag gaps so the client can decide what to close before the score is calculated.

How we hand over

Handover includes the documentation, configuration records, evidence index and POA&M tracker the client needs to present to its Affirming Official and assessor.
We walk the client's team through what each artifact shows, so the organization can explain its controls without relying on us during review.
Clients own the environment, the affirmations and the SPRS entries; we do not sign, submit or certify on their behalf.

How we support

Ongoing support, upgrades and continuous testing are available as a retainer after the initial engagement closes.
Retainer work can keep POA&M items moving toward closeout within the 180-day window and refresh evidence as systems change.
Before engaging us, ask for the written scope, the deliverables list and the support terms in your quote, and confirm the current CMMC rules with your contracting officer.