CMMC Compliance CheckCMMC POA&M rules
A plan of action and milestones (POA&M) lets a contractor reach a Conditional CMMC status with a few open items. 32 CFR 170.21, POA&M requirements limits what can go on it.
Level 1: never
No POA&M is allowed for a Level 1 self-assessment. All 15 requirements must be met.
Level 2: three conditions
- The score divided by 110 is at least 0.8, so at least 88.
- Every requirement on the POA&M is worth 1 point. The one exception is 3.13.11 when encryption is used but isn't FIPS-validated (3 points).
- None of these is on the POA&M: 3.1.20, 3.1.22, 3.12.4, 3.10.3, 3.10.4, 3.10.5.
That leaves 46 one-point requirements, plus 3.13.11 in its partial state, that can be on a Level 2 POA&M. A 3- or 5-point requirement that isn't met has to be fixed before you can claim any Level 2 status.
180 days to close
A Conditional status lasts 180 days from its status date. In that time the open items must be fixed and confirmed by a POA&M closeout assessment: done by you for a self-assessment, by a C3PAO for a certification. If it isn't closed in time, the Conditional status expires (32 CFR 170.16, Level 2 self-assessment).
A POA&M doesn't make a requirement met
The scoring rule is explicit: a requirement that isn't implemented is scored NOT MET whether it is on a POA&M or not (32 CFR 170.24, CMMC Scoring Methodology). Temporary deficiencies already being fixed under an operational plan of action are a different thing and can be assessed as met.