CMMC POA&M rules: 88-point threshold and 180 days

When does CMMC allow a POA&M, and how much can it cover?

A Level 2 plan of action and milestones (POA&M) is allowed only when the assessment score is 88 or more out of 110, and it may cover only requirements worth 1 point under the scoring methodology, with one exception for SC.L2-3.13.11 CUI encryption when encryption is used but not FIPS-validated. At Level 1, no POA&M is permitted at all, because every Level 1 requirement must be MET. If your prime or contract requires a CMMC status and your assessment found gaps, the first question is not how to write the plan but whether the score and the NOT MET requirements allow a Conditional status in the first place. The answer changes with three factors. The first is the score, since a 3-point or 5-point NOT MET requirement pulls the total down quickly and can push a near-passing result below 88. The second is which requirements failed, because six requirements can never go on a POA&M, including AC.L2-3.1.20 external connections, CA.L2-3.12.4 system security plan, and the three physical protection requirements PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5. The third is whether the assessment is self or C3PAO, which changes who runs the closeout. For Level 2 (Self), the contractor performs the POA&M closeout assessment. For Level 2 (C3PAO), a C3PAO performs it. Your organization owns its controls and the affirmation of them. DeployOpen can prepare systems, documentation and evidence for the closeout, but DeployOpen does not issue reports, attestations or certificates. Only the closeout assessor does that. Before you commit to a POA&M, confirm three things with your score worksheet and your contracting officer or prime: the exact point value of each NOT MET requirement under the scoring methodology, whether any of the six barred requirements is open, and the date the Conditional status would start, since the 180-day closeout window runs from it. Also confirm which assessment type your contract accepts while the current phase-in rules remain in effect. Those answers decide whether a POA&M is a viable path or whether the gaps must be closed before any assessment is submitted.

Which requirements can never go on a POA&M

Under the CMMC Level 2 rules, most NOT MET requirements can be carried on a POA&M while a contractor closes them out. Six requirements are excluded from that option entirely, so a gap in any of them keeps the assessment from reaching Conditional status, whatever the total score. The cards below cover each one and what to verify before an assessor arrives.

External connections (AC.L2-3.1.20)

This requirement asks the organization to control how its systems connect to external systems, including which outside systems may be used, under what terms, and with what controls in place. A gap here cannot be deferred to a POA&M, so the connection rules must be working before assessment. Check that every external system, cloud tenant, partner link and remote service has a documented connection agreement, an owner, and enforced technical limits. Confirm that personal or unmanaged accounts cannot reach CUI through any path.

Public information control (AC.L2-3.1.22)

This requirement covers how publicly accessible systems and content are handled, so that CUI is never posted to publicly accessible locations and public postings are reviewed before release. Because it cannot be placed on a POA&M, a missing review step blocks Conditional status by itself. Check that a named person approves anything published on websites, file shares, social media or public repositories, and that the review is recorded. Look for publicly reachable storage that might hold CUI.

System security plan (CA.L2-3.12.4)

This requirement asks for a current system security plan that describes the system boundary, the operating environment, how each requirement is implemented and who is responsible for it. The plan must be final before assessment, because a missing or outdated SSP cannot be carried as a deficiency. Check that the SSP names every in-scope asset, matches the network diagram, and reflects the current state of controls rather than a planned state. Confirm the plan has a version history and an owner who signs off on changes.

Escorting visitors (PE.L2-3.10.3)

This requirement concerns visitors to facilities that house CUI, requiring that they be escorted and that their activity be monitored. The control is basic but easy to find missing during a walkthrough, and a gap cannot be deferred. Check that the visitor procedure is written, that receptionists and staff know it, and that badge or sign-in records show escorted access. Confirm that contractors and delivery staff are covered by the same rule, not only employees.

Physical access logs (PE.L2-3.10.4)

This requirement asks the organization to keep logs of physical access to facilities and equipment that hold CUI, so that entries can be reviewed later. Missing logs cannot be fixed through a POA&M while the assessment is pending. Check that logs exist for every door, server room and cabinet in scope, that they capture who entered and when, and that someone reviews them on a defined schedule. Confirm retention periods and that logs cannot be edited by the people they track.

Physical access management (PE.L2-3.10.5)

This requirement covers managing physical access devices such as keys, badges and codes, including issuing, changing and retrieving them. It is the third physical protection item that cannot go on a POA&M, so a lapse in badge control blocks Conditional status even if the score is high. Check that there is an inventory of keys and badges, that access is removed promptly when staff leave, and that shared codes are changed on a set schedule. Verify that these records match what the assessor will see at the door.

The 1-point limit and the CUI encryption exception

Only requirements worth 1 point under the scoring methodology can go on a Level 2 POA&M. Under 32 CFR 170.21(a)(2)(ii), a contractor that reaches the 88-point threshold can carry open items only if each one is a 1-point requirement. Every other NOT MET requirement must be fixed before the assessment can end in Conditional status. The practical step is to take the assessor's scoring worksheet, or your own mock assessment scoring, and sort each NOT MET item by its point value before deciding anything. A 3-point or 5-point gap cannot be parked on a POA&M, so it can move your score below the threshold even when the total looks close to passing.

The one named exception is SC.L2-3.13.11, which covers CUI encryption. It may go on a POA&M when encryption is in use but the cryptographic modules are not FIPS-validated. Scored as a 3-point deduction, it still qualifies for the POA&M path because the exception is written into the rule. The consequence is that an organization with encryption already deployed, but on modules that lack FIPS validation, can still reach Conditional status if its total stays at or above 88 points. The deadline for replacing those modules then runs on the 180-day closeout clock. Confirm with each vendor, in writing, whether the modules in your CUI boundary carry a current FIPS validation, and check the certificate status against the validation listing yourself rather than relying on a marketing statement.

Do not treat the exception as a general allowance for encryption gaps. If the encryption is absent, misconfigured, or applied to only part of the CUI flow, the SC.L2-3.13.11 exception does not apply and the item scores as a full NOT MET. Document the modules, versions and the data paths they protect in the system security plan so an assessor can trace each encrypted flow to a validated or non-validated module. Ask your managed service providers and cloud vendors the same questions, because their modules may sit inside your CUI boundary.

How the 180-day closeout works

The closeout sequence shows an assessor that the NOT MET requirements on a POA&M have been fixed, which moves a Conditional status to Final status and keeps the three-year cycle running from the original Conditional date.

Receive the Conditional status and start the clock
A Level 2 assessment ends in Conditional status only when the score ratio reaches at least 0.8 and every item on the POA&M is eligible. The 180-day closeout window runs from the Conditional status date, not from the date the organization decides to start remediation. Record that date in the organization's compliance tracker and in the SPRS entry so the deadline is visible to leadership, the Affirming Official and the contracting team. The step is complete when the date and the list of NOT MET requirements are confirmed in writing internally.
Build the POA&M remediation plan
Work through each NOT MET requirement on the POA&M and assign an owner, a fix and evidence that will satisfy every applicable assessment objective in NIST SP 800-171A. Confirm that each item is one the rule allows on a POA&M, since the six barred requirements and the 1-point limit still apply during remediation. Plan the fixes so they can be finished within the 180 days, and identify early any fix that depends on a third party such as a cloud provider or hardware vendor. The step is complete when each item has a named owner and a written evidence list.
Implement fixes and produce final evidence
Engineers and administrators change the configurations, policies, accounts or processes that caused each deficiency. Each change must leave evidence in final form, such as approved policy text, configuration exports, logs, tickets or training records, rather than drafts. Where a fix touches the system security plan, update the SSP so it matches the operating environment. The step is complete when each NOT MET item has evidence that an assessor could review without the organization explaining it.
Run an internal check against the NOT MET items
Before requesting the closeout assessment, test each remediated requirement against the NIST SP 800-171A objectives and confirm that the evidence is complete and current. Only the NOT MET requirements are in scope for closeout, so this check focuses on those items and on any change that could affect them. Record the results and correct any gap now, since a failed closeout uses the same limited window. The step is complete when the internal check shows every NOT MET item is ready for independent review.
Complete the closeout assessment
The closeout assessment checks only the NOT MET requirements listed on the POA&M, not the full Level 2 set. For a Level 2 (Self) closeout, the contractor performs the assessment itself. For a Level 2 (C3PAO) closeout, a C3PAO performs it. The assessment must be completed within 180 days of the Conditional status date. The step is complete when the assessment result is recorded and the requirements that passed are documented for submission.
Submit closeout results and update SPRS
Enter the closeout results in the required systems and update the SPRS entry so it reflects the closed items and the current score. Confirm with the contracting team which submission path applies to the contract at hand, since the eMASS and SPRS process differs by assessment type. Retain the closeout records with the original assessment records. The step is complete when the submission is confirmed and the record shows the closed POA&M items.
Reach Final status and keep the original cycle date
Under DFARS 252.204-7021(d)(5), a contractor holding a Conditional status must successfully close out a valid POA&M to reach Final status. After a successful closeout, the CMMC status date remains the Conditional status date, so the three-year assessment cycle continues from that original date. Confirm the Final status and the next assessment due date in writing before relying on them in a bid or contract. The step is complete when the Final status and the unchanged status date are recorded and communicated to the contracting team.

What happens if the POA&M is not closed in 180 days

If the POA&M is not closed within 180 days of the Conditional status date, the Conditional status expires. The Conditional status expires outcome is automatic: it does not depend on a decision by the assessor or the contracting officer, so the clock on the closeout assessment is the single most important schedule to track once a Level 2 assessment ends in Conditional. Under 32 CFR 170.16 and 170.17, if the lapse happens while a contract is in force, standard contractual remedies can apply, and the contractor cannot win new awards that require that status until it achieves a new one. For a company whose revenue depends on pursuing follow-on work, that second consequence is often more damaging than the first.

The three-year assessment cycle is easy to misread here. Under 32 CFR 170.4, a successful closeout does not reset the CMMC status date, which stays the date of the Conditional status, so the three-year cycle runs from the original Conditional date. A contractor that closes its POA&M late in the 180-day window still has to plan its next assessment against that earlier date. Put the Conditional date, the 180-day closeout deadline and the start of the next assessment window on the same calendar, and assign an owner to each.

Contract-specific remedies depend on the clauses in each contract, the agency's approach and the terms of any subcontract that flows the requirement down, so treat the general rule as a starting point only. Ask the contracting officer how the agency would respond to a lapsed Conditional status on an active award, and have counsel review the remedies in the contract and any flowdown terms. Confirm the current phase-in status and assessment rules with the DoW CIO before relying on any schedule for planning.

POA&M or operational plan of action: which one fits the gap

A plan of action and milestones covers assessment deficiencies: requirements the assessor finds NOT MET during a Level 2 assessment that the organization is allowed to fix after the assessment. Its entries count toward the score, and they are the only route to a Conditional status. The POA&M must be closed through a closeout assessment within 180 days of the Conditional status date, and the closeout checks only the NOT MET requirements on that list.

Scoring effect: Items on the POA&M remain NOT MET for scoring, and the total must still reach the 0.8 ratio threshold to qualify.
Eligibility limits: Only 1-point requirements can go on the list, with the encryption exception for SC.L2-3.13.11 noted in the rule. Six requirements can never be deferred.
Closeout clock: The 180-day window starts at the Conditional status date, not at the date the gap was found.
Who checks it: The assessor decides whether an item is an assessment deficiency that belongs here.

Before you add an item, confirm its point value under the scoring methodology and check whether it is on the list of barred requirements.

How to check POA&M eligibility before the assessment

A POA&M is only available if your score clears the threshold and every open item is one the rules allow you to defer. The cards below walk through the checks to run internally before a Level 2 assessment begins. DeployOpen can help prepare evidence and systems, but the score itself comes from the assessor.

Map each NOT MET item to its points

Start with every requirement you expect to fail and record its point value under the 32 CFR 170.24 methodology. Most requirements are worth 1, 3 or 5 points, and a 5-point item such as AC.L2-3.1.1 costs far more score than a 1-point item. Subtract each NOT MET value from the 110 maximum and check whether the result stays at or above 88. A negative total cannot support a POA&M at all. Confirm the values against the current scoring rules, not from memory.

Confirm the six barred items are fully MET

Six requirements can never sit on a Level 2 POA&M: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5. Check each one against the assessment objectives with final, dated evidence, such as an approved system security plan, current access logs and a signed escort procedure. A draft document or a verbal process does not count. If any of these is open, the assessment cannot end in Conditional status with a POA&M, regardless of score.

Check encryption and FIPS status

Only 1-point requirements may go on a POA&M, with one exception: SC.L2-3.13.11 for CUI encryption. That item may be deferred when encryption is in use but the module is not FIPS-validated, and it carries a 3-point deduction. Identify every system that protects CUI in transit or at rest, record the cryptographic module name and its validation status, and confirm the validation certificate is current. Ask your IT team to check whether any tool, VPN or storage service uses non-validated cryptography before assuming the exception applies.

Separate POA&M items from operational plan items

A POA&M covers assessment deficiencies that must be closed within the closeout window. An operational plan of action under CA.L2-3.12.2 tracks ongoing vulnerabilities without a fixed remediation date. Sort every open issue into one of these two lists. Temporary deficiencies properly tracked in an operational plan are assessed as MET, which protects both your score and your ability to reach Conditional status. Mislabeling an item in either direction creates avoidable risk at assessment time.

Name an owner and evidence for each closeout item

For every item that will go on a POA&M, record a named owner, a remediation step, the evidence that will prove the fix, and a target date that falls inside the 180-day closeout window. The closeout assessment checks only the NOT MET requirements, so each item needs artifacts that show the requirement is now satisfied, such as configuration exports, policy approvals or scan results. Owners should be people who can produce those artifacts without help from a consultant. Keep the register in version control so the history is visible.

Document enduring exceptions in the SSP

Some assets, such as medical devices, test equipment, OT or IoT, cannot meet a requirement fully. An enduring exception documented with mitigations in the system security plan is assessed as MET, so it does not need a POA&M entry. Identify these assets early, write the justification and compensating controls into the SSP, and confirm with your assessor how they will be scored. Do not place an enduring exception on the POA&M by default, because that changes how it is treated.

Frequently asked questions about CMMC POA&M rules

Can a Level 1 self-assessment use a plan of action and milestones?

No. Under 32 CFR 170.21(a)(1), no POA&M is permitted for a Level 1 self-assessment, so every Level 1 requirement must be MET before the affirmation is made. Level 1 covers only Federal contract information and its 15 safeguarding requirements, which means the scoring is all or nothing. If a Level 1 gap exists, the organization has to fix it or stop handling FCI in that system before it can claim compliance. Read the exact wording in the eCFR text of 32 CFR 170.21 and confirm with your contracting officer how your specific contract applies.

What is the 88-point threshold for a Level 2 POA&M?

The 88-point threshold is the minimum score that allows a Level 2 assessment to end in Conditional status with a POA&M. Under 32 CFR 170.21(a)(2), the score divided by the 110 Level 2 requirements must be at least 0.8. Scoring starts at 110 and subtracts points for each NOT MET requirement at 5, 3 or 1 points, so a few high-weight gaps can push a score below 88 even when most requirements are met. Before an assessment, run a mock score against the scoring rules in 32 CFR 170.24 so you know whether a POA&M is even available.

Can a POA&M cover a 5-point requirement?

No, a POA&M can only include requirements worth 1 point under the scoring methodology. Under 32 CFR 170.21(a)(2)(ii), 5-point items such as AC.L2-3.1.1 and IA.L2-3.5.1 must be MET at assessment time. The one exception to the 1-point limit is SC.L2-3.13.11, CUI encryption, which can go on a POA&M when encryption is used but is not FIPS-validated, and it carries a 3-point deduction. Because the 1-point rule is strict, an engineer should identify high-weight gaps early, since these cannot be deferred to a closeout window.

What does the encryption exception in SC.L2-3.13.11 cover?

The encryption exception covers CUI encryption where encryption is in use but the cryptographic modules are not FIPS-validated. It is the only requirement worth more than 1 point that may appear on a Level 2 POA&M. It does not allow an organization to skip encryption, and it does not cover unencrypted CUI. The exception still carries a 3-point deduction, so it must be closed within the 180-day window. Engineers should check which modules protect CUI in transit and at rest, confirm their FIPS validation status with the module vendor, and document the plan in the system security plan.

Does the 180-day POA&M closeout need a C3PAO?

It depends on the assessment type. Under 32 CFR 170.21(b), the closeout assessment checks only the NOT MET requirements on the POA&M and must be completed within 180 days of the Conditional status date. The contractor performs it for a Level 2 self-assessment, a C3PAO performs it for a Level 2 certification assessment, and DCMA DIBCAC performs it for Level 3. Organizations often hire consultants to prepare evidence, but the consultant cannot be the party that issues the closeout result. Confirm the assessor role, schedule and evidence requirements with your assessor before the clock starts.

What happens if the POA&M is not closed within 180 days?

The Conditional status expires, and the contractor loses the ability to win new awards that require that status until it achieves a new one. If this happens during a contract, standard contractual remedies apply. Under 32 CFR 170.16 and 170.17, the expiration affects the organization's standing, not just the open items. DFARS 252.204-7021 also requires a contractor holding Conditional status to close out a valid POA&M to reach Final status. Because the status date stays the Conditional date after a successful closeout, a lapse also disrupts the three-year cycle, so plan remediation with a firm end date and a fallback owner.

How does a POA&M differ from an operational plan of action?

A POA&M tracks assessment deficiencies that must be fixed within 180 days, and it can only be used under the score and eligibility rules above. An operational plan of action, required by CA.L2-3.12.2, tracks ongoing vulnerabilities and has no remediation timeline. Under 32 CFR 170.4 and 170.24(b), temporary deficiencies properly tracked in an operational plan of action are assessed as MET. Confusing the two is a common mistake: an item that belongs in an operational plan may still fail an assessment if it is written up as a POA&M item, so confirm with your assessor which tracker each finding belongs in.

How DeployOpen prepares systems and evidence before a POA&M closeout

DeployOpen works on the systems and evidence behind a CMMC Level 2 POA&M, so each NOT MET requirement can be fixed and shown as final before the 180-day closeout window closes. The organization owns its controls and POA&M decisions, and only an independent C3PAO or the contractor's own closeout assessment, as the rule defines it, reaches a finding.

How we scope

Written scope lists which NOT MET requirements sit on the POA&M and which assets, enclaves and external providers they touch.
Scope confirms which items are eligible under the one-point rule and which, such as the six barred requirements, must already be MET.
Engagements are fixed-scope, with deliverables and timelines agreed in writing before remediation work begins.

How we build

Remediation is built into the client's own infrastructure, including cloud accounts, data centers or air-gapped networks.
Each POA&M item is fixed with configuration, logging, access or hardening changes, then tested against the NIST SP 800-171A objectives.
Where a temporary gap remains, operational plan of action entries and documented exceptions are kept distinct from POA&M items.

How we hand over

Deliverables include system security plan updates, configuration records and evidence packages in final form, not drafts.
A requirement-by-requirement evidence index maps each closed item to the artifacts an assessor will sample.
Handover documents the remaining steps and the owner of each item, so the organization can run its own closeout check.

How we support

Ongoing support, upgrades and continuous testing are available as retainers after handover.
Retainers can keep evidence current through the Conditional status period and between assessment cycles.
Questions about what an independent assessor will accept are routed to that assessor, since DeployOpen does not issue findings.

CMMC POA&M rules