POA&M Under CMMC: What's Allowed and the 180-Day Clock

Phase II certification requirements are currently suspended for review. The Conditional Status rules in 32 CFR 170.21 still describe Level 2 self-assessment and certification paths, but they are not a substitute for checking the assessment type in a current Phase I acquisition. Read the July 2026 program update before planning around a certification date.

The Plan of Action and Milestones is the most misunderstood mechanism in the entire CMMC program. Contractors tend to hear "POA&M" and relax, imagining it as a way to certify now and fix things later. The reality written into the CMMC program rule is far narrower and far stricter: a POA&M is a short, tightly bounded bridge available only to organizations that are already nearly compliant, it excludes exactly the controls you might most want to defer, and it runs on a hard 180-day clock with no built-in extension. This post lays out what is actually allowed, grounded in 32 CFR 170.21, so you can plan an assessment date honestly rather than optimistically.

What a POA&M is in the CMMC context

Outside CMMC, a POA&M is a familiar governance artifact: a documented plan listing unmet requirements, the actions to remediate them, and the milestones and dates for doing so. Inside CMMC, it acquires a specific legal function. When a Level 2 certification assessment finds that some — but not too many — requirements are not yet met, and those requirements fall within the permitted set, the C3PAO can issue a Conditional CMMC Status rather than an outright failure. Conditional status lets you be treated as meeting the requirement for award purposes while you finish the listed remediation. Final CMMC Status is what you hold once the POA&M is closed and verified. The whole mechanism lives in 32 CFR 170.21, and every constraint below flows from that section.

The eligibility rules: what is actually allowed

Three gates decide whether a POA&M is even available to you, and all three must be satisfied.

The 80% floor

You cannot POA&M your way up from a poor assessment. To be eligible for Conditional status, your assessment must reach a minimum score of 88 out of 110 — an 80% threshold measured on the weighted DoD Assessment Methodology scale used for your SPRS score. If your weighted deductions push you below 88, there is no conditional path; the assessment is not passed, and no POA&M is offered. That is a weighted-score threshold, not a percentage of requirements implemented or evidence of control effectiveness.

Only the permitted requirements

A score of at least 88 is necessary, but it does not make all one-point gaps eligible. Section 170.21(a)(2)(iii) expressly prohibits these six requirements from a Conditional Level 2 POA&M: AC.L2-3.1.20 External Connections, AC.L2-3.1.22 Control Public Information, CA.L2-3.12.4 System Security Plan, PE.L2-3.10.3 Escort Visitors, PE.L2-3.10.4 Physical Access Logs and PE.L2-3.10.5 Manage Physical Access. The five listed access/physical requirements have one-point weights; the SSP is a prerequisite rather than a scored one-point gap. Requirements with a value greater than one are also excluded, except for the specified encryption case below. Weight-tier totals therefore cannot establish eligibility; identify each open requirement. 32 CFR 170.21, DoD methodology, Annex A.

There is one narrow, frequently-cited exception worth knowing precisely. The CUI encryption requirement, SC.L2-3.13.11, is normally a 5-point control, but it may be placed on a POA&M when you are already encrypting CUI and the only deficiency is that the cryptography is not yet FIPS-validated — in which case it is treated as a 3-point deduction. It is the exception that proves the rule: even the permitted heavy-control case requires that the substance (encryption) already exists and only the validation is outstanding.

It is a Level 2 and Level 3 mechanism only

POA&Ms do not exist at Level 1. A Level 1 self-assessment requires that all fifteen basic safeguarding requirements be met, full stop — there is no conditional status and no remediation window at the foundational level. Section 170.21 permits conditional paths for Level 2 self-assessment, Level 2 certification assessment and Level 3 certification assessment, with different requirement exclusions and closeout authorities. A DoD Basic self-assessment posted to SPRS is not itself CMMC Level 2 Self Status.

The 180-day clock

A POA&M closeout assessment must confirm closure within 180 days of the Conditional CMMC Status Date. The deadline does not start separately when each item is opened. For Level 2 Self, the organization performs the closeout self-assessment in the same manner as its initial self-assessment. For Level 2 certification, an authorized or accredited C3PAO performs closeout. For Level 3, DCMA DIBCAC performs it. If the plan is not successfully closed within that window, Conditional Status expires. 32 CFR 170.21(b).

Plan the applicable closeout assessment when the conditional window begins. For a certification assessment, arrange the assessor and evidence review early enough to finish within the shared deadline; a late new item does not earn an additional 180 days.

Why the design is strict, and how to read it

It is tempting to see these constraints as bureaucratic cruelty, but the design has a coherent logic. The POA&M exists so that a contractor who is genuinely ready — who has closed the hard controls and holds a strong score — is not failed over a handful of minor, late-closing items. It does not exist to let an under-prepared organization certify on promises. The heavy-control exclusions and the 80% floor together ensure the mechanism rewards being nearly done, not being willing to start. Reading it that way changes how you plan: the POA&M is the last five percent of a readiness program, not the first draft of one.

Managing it in practice

Before assessment, identify the exact open requirements and distinguish prohibited items from potentially permitted ones. Check all six named Level 2 exclusions, the greater-than-one-point restriction, the narrow encryption exception and the score condition separately. An aggregate count cannot make that decision. Record each permitted item's owner, work, evidence and closeout milestone against the shared deadline. Level 3 uses its own named exclusions in §170.21(a)(3).

Score and eligibility are separate checks. A weighted score above the floor does not make every unmet requirement eligible for a POA&M. Identify each requirement precisely, check the applicable exclusion or exception, and document the remediation and verification needed. Do not infer eligibility from a general label such as “logging gap” or “access issue.” Sorting the requirements early lets the team identify excluded gaps before selecting an assessment date.

Where Valty fits, honestly

Valty is not a C3PAO and does not issue CMMC certifications. The applicable closeout authority is the OSA for Level 2 Self, an authorized or accredited C3PAO for Level 2 certification, or DCMA DIBCAC for Level 3. What the platform does is manage the POA&M lifecycle as readiness support: organizing requirement-level evidence and review ownership, comparing scoring assumptions with the 88/110 condition, tracking milestones against the applicable closeout deadline, and generating the OSCAL POA&M artifact in the form an assessment package expects. It is decision-support for arriving at — and getting through — the assessment honestly, not a substitute for the assessor's judgment. For the full timeline and mandate context, see the CMMC overview and the federal and regulatory capability page; if you have not yet established a baseline, the companion post on calculating your SPRS score is the place to start.

Inspect the fictional sample decision memo, or request a platform demo to explore the supported workflow with illustrative data. Company scope, evidence handling, access, onboarding and commercial terms are agreed separately before evaluation.