What score do you need for CMMC Level 2 Conditional status?

At least 80% of the maximum score, which is 88 out of 110, with every remaining open item eligible for a POA&M under 32 CFR 170.21.

How long do you have to close a CMMC POA&M?

180 days from Conditional status. A POA&M closeout assessment must verify every item is met, or Conditional status expires.

Home / Answers / CMMC / GovCon

CMMC / GovConAnswersCISSP · 22 years

What are the POA&M rules for CMMC Level 2?

Short answer

Under 32 CFR 170.21, you can get Conditional Level 2 status with open items only if you score at least 88 of 110, every open item is worth one point (with one partial exception for FIPS-validated encryption), and none is on the never-allowed list. All items must be closed and verified within 180 days, or Conditional status expires. Level 1 allows no POA&Ms at all.

The rules

Four tests every open item must pass

Score floor: the assessment score must be at least 80% of the maximum, which is 88 of 110.
One-point items only: requirements worth more than one point cannot be on a POA&M. The exception is SC.L2-3.13.11: if encryption is used but is not FIPS-validated, it can be.
Never-allowed list: six requirements can never be on a POA&M, whatever their value (table below).
180 days: a POA&M closeout assessment must confirm every item is met within 180 days of Conditional status. If it doesn't, Conditional status expires.

At a glance

Key facts

Never on a POA&M	Requirement
AC.L2-3.1.20	External connections are verified and controlled
AC.L2-3.1.22	Control of CUI posted on publicly accessible systems
CA.L2-3.12.4	System Security Plan
PE.L2-3.10.3	Escort and monitor visitors
PE.L2-3.10.4	Physical access logs
PE.L2-3.10.5	Manage physical access devices

The trap

Why the SSP matters most

CA.L2-3.12.4, the System Security Plan, is on the never-allowed list for a reason: without it there is no defined boundary to assess. Organisations that treat the SSP as paperwork to finish last discover it is the document the assessment depends on. Write it first, and keep it matching reality.

Do not confuse a POA&M with an operational plan of action. The latter covers temporary deficiencies from changes in an otherwise compliant environment, and is a separate concept in the rule.

In the boardroom

Questions a director should ask

What is our current score out of 110, and how many open items are worth more than one point?
Are any of the six never-allowed requirements open today?
Does our System Security Plan match the environment as it is, not as it was designed?
If we got Conditional status tomorrow, could we close everything within 180 days?

Sources

Primary sources

Need this answered for your board?

Board reporting, AI governance, DPDP readiness or CMMC. Tell me which and what the constraint is.

me@sarfarazchougule.com →