CMMC POA&Ms
What Can Be Deferred, the 180-Day Closeout Rule, and Conditional Status
A CMMC POA&M is not a general deferral mechanism. It is a narrowly defined, time-limited instrument — allowing only organizations with minor, eligible deficiencies to achieve provisional certification while remediating under a strict 180-day countdown.
Under DFARS 252.204-7021, a POA&M "identifies tasks to be accomplished, details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates." In CMMC, that means a documented remediation commitment — not a wishlist, not a workaround, and not a substitute for genuine compliance.
Quick-Reference: The POA&M If/Then Rules
| Condition | Result |
|---|---|
| IF → Organization scores below 88/110 | Assessment fails — no POA&M, no Conditional Status |
| IF → Any 5-point control is NOT MET | Cannot use POA&M — assessment fails on that control |
| IF → Score ≥ 88/110 and all failures are eligible controls | Conditional CMMC Status granted — 180-day clock starts |
| IF → Conditional Status is granted | POA&M closeout assessment must be completed within 180 days |
| IF → Closeout assessment passes within 180 days | Status upgrades to Final CMMC — valid for 3 years |
| IF → Closeout is not completed within 180 days | Conditional Status expires — must restart full assessment |
The Two Eligibility Gates
Two conditions must both be met before any POA&M is possible:
Minimum SPRS Score: 88 of 110
Below that threshold, there is no Conditional Status and no POA&M — only a failed assessment. This is approximately 80% of the total possible score.
All 5-Point Controls Must Be Fully Implemented
FIPS cryptography, MFA, access control enforcement. A 5-point failure cannot be deferred. It disqualifies the entire assessment.
The interim certificate is issued. CMMC UID recorded in SPRS. Every deferred item must be closed and verified before Day 180 — no exceptions.
What Can and Cannot Go on a CMMC POA&M
| Control / Practice Type | Weight | POA&M? | Notes |
|---|---|---|---|
| Any 5-point control (FIPS encryption, MFA, access control enforcement) | 5 pts | NO | Must be fully implemented before the assessment begins. A 5-point failure disqualifies the assessment. |
| Select 3-point controls — partially implemented | 3 pts | LIMITED | Only if partially implemented (not fully absent). Assessors evaluate whether "partially implemented" genuinely applies. |
| Most 1-point controls — minor configuration gaps | 1 pt | YES* | Eligible if score ≥ 88/110. Specific excluded 1-point CUI controls are not eligible regardless of weight. |
| Excluded 1-point CUI controls (DoD-specified list) | 1 pt | NO | Even though weighted at 1 point, certain controls are explicitly excluded from POA&M deferral by DoD. |
| Any control that produces a score below 88/110 | Varies | NO | Even eligible control types cannot be POA&M'd if the total score drops below the minimum threshold. |
* "YES" means the control type is eligible — not that any specific failure is automatically POA&M-able. Assessors evaluate each failure individually.
The 180-Day Closeout Rule — Absolute and Unforgiving
If the 180-day deadline passes with any POA&M item still open, Conditional Status expires. The CMMC UID in SPRS no longer reflects a compliant status. The organization must restart the full assessment process.
Closeout Planning Essentials
- 01Know your score before assessment day. Internal pre-assessment reviews should classify every gap: must fix now (5-point / excluded), eligible for POA&M, or already implemented.
- 02Reserve POA&M for small, fast, certain fixes. Policy updates and configuration adjustments are appropriate. Network re-architecture and vendor replacements are not.
- 03Schedule the closeout assessment with buffer time. Complete remediation by day 140–150. Book the C3PAO for day 155–165. Leave margin for evidence questions.
- 04Do not call the C3PAO back until all items are verified closed. Any item found open during the closeout visit restarts the remediation clock while the 180-day deadline continues running.
- 05The eMASS update is the finish line. When the assessor uploads a clean POA&M to eMASS, the Cyber AB is notified and Final CMMC Status is confirmed. Your 3-year certification clock begins.
Frequently Asked Questions
The Bottom Line
Know your score before assessment day. Implement all 5-point controls before the assessor arrives. Reserve the POA&M for minor, genuinely closeable items. Schedule the closeout with buffer. Verify every item is closed before calling the C3PAO back.
Follow that sequence and the 180-day window is a reasonable runway. Ignore it — or mistake the POA&M for a general deferral mechanism — and it becomes a countdown to a failed certification and a full assessment restart.