CMMC Level 2 Conditional Status and the 180-Day POA&M Closeout Rules Explained (32 CFR 170.21)

A POA&M is a limited conditional route

A Plan of Action and Milestones records an identified gap, accountable owner, remediation steps, completion dates and verification evidence. Under 32 CFR 170.21, conditional CMMC status is permitted only within specific restrictions. It is not a general exemption from implementing required safeguards.

Keep an internal remediation register for all gaps, even those that cannot legally remain on a conditional POA&M. Distinguish that broader work list from the eligible POA&M supporting a conditional assessment. Calling a high-weight gap a “milestone” does not make it eligible.

The score floor: at least 88, not automatic approval

The Level 2 conditional score threshold is at least 0.8 of the maximum assessment score, commonly expressed as 88 of 110. This uses the weighted assessment methodology, not a count of 88 completed controls. You can have more than 88 controls implemented and still fall below the score floor.

In addition to the score, every unresolved requirement must qualify for conditional treatment. The workspace presents the score and restriction warnings separately so a passing arithmetic threshold cannot conceal a disallowed gap. Scope, evidence and the required assessment type remain necessary.

Restricted requirements must be satisfied first

Ordinarily, requirements with deductions greater than one point cannot remain on a Level 2 conditional POA&M. The six specifically prohibited requirements are AC.L2-3.1.20 (external connections), AC.L2-3.1.22 (public information), CA.L2-3.12.4 (SSP), PE.L2-3.10.3 (visitor escort), PE.L2-3.10.4 (physical access logs) and PE.L2-3.10.5 (physical access devices).

The SSP is also a prerequisite to a meaningful assessment. A blank document with the title “SSP” is not an implemented system description. It should describe the boundary, operating environment, implementation of requirements and relationships with interconnected systems. Resolve this before relying on conditional scoring.

The narrow encryption exception

SC.L2-3.13.11 has a specific exception where encryption is employed but not FIPS-validated, giving the qualifying three-point deduction. No encryption is not this exception. Document the actual cryptographic implementation and the validation gap, not just a statement that “encryption exists.”

MFA also has a methodology-specific partial deduction, but that does not make IA.L2-3.5.3 POA&M-eligible. Partial scoring and conditional eligibility are different rules. Check both when reviewing the remediation register.

Closeout within 180 days of conditional status

The closeout window is 180 days from the Conditional CMMC Status Date, not from the day a task was created in a spreadsheet. Record the status date and calculate the deadline once. A project delay, changed supplier or missed milestone does not restart the regulatory clock.

Plan time for implementation, evidence collection, required closeout assessment and the associated affirmation. Set control target dates before the final deadline. Where the deadline is at risk, escalate early to the prime and appropriate advisors rather than claiming completion without evidence.

A useful remediation record

Each gap needs an owner, a concrete corrective action, intermediate milestones, a target date and the evidence that will establish the requirement is met. “Purchase a license” is rarely enough: configuration, deployment coverage, operational use and verification are usually also necessary.

TRNSFRM can help scope turnkey CUI implementation when internal resources are insufficient. Its Cleveland and Columbus, Ohio team serves defense contractors nationwide. AffirmTrail exports your draft register and statements but does not implement, certify or submit them.

Official sources

• 32 CFR 170.21: POA&M restrictions and deadlines
• 32 CFR 170.22: affirmation after closeout