Guide
CMMC Level 2 POA&M rules: what you can and cannot defer
A Plan of Action and Milestones (POA&M) lists the security requirements you have not met yet and when you will fix them. Many small contractors assume that writing a gap into a POA&M makes it acceptable. Under CMMC it often does not. The rule that decides is 32 CFR 170.21, and it is short enough to explain on one page.
Written by WorkuGRC. Last updated .
The short version
- You need a score of at least 88 out of 110.
- Only requirements worth 1 point can be deferred, with one narrow exception.
- 6 named requirements can never be deferred.
- Everything deferred must be closed within 180 days.
Two different uses of the word POA&M
NIST SP 800-171 itself asks you to keep plans of action for correcting deficiencies (requirement 3.12.2). In that everyday sense, every gap you have belongs in your plan, and you should track all of them.
CMMC adds a narrower question: which unmet requirements may still be open when you claim a Conditional Level 2 status. That is what 32 CFR 170.21 limits, and it is what the rest of this page is about. A gap can be in your plan and still block a conditional status.
Rule 1: a score of at least 88
The regulation requires your assessment score divided by the 110 Level 2 requirements to be at least 0.8. That is 88 points, so you can be missing at most 22 points in total. Below 88, a conditional status is not available, whatever your POA&M says.
If you do not know your number yet, the free score calculator gives an estimated range in a few minutes.
Rule 2: only 1-point requirements, with one exception
The DoD scoring method weights each requirement at 5, 3, or 1 point. A requirement on a Level 2 POA&M may not be worth more than 1 point. In practice that means every 5-point and 3-point requirement has to be fully in place first. Those are the ones the Department treats as the foundation: multifactor authentication, incident response, security training, audit logging, and similar.
The single exception is requirement 3.13.11 (encryption of CUI). It may be on the POA&M when you are using encryption but the encryption is not FIPS-validated, which scores as a 3-point gap. With no encryption at all, it cannot be deferred.
Of the 109 scored requirements, 46 are 1-point items that the rule allows on a POA&M.
Rule 3: 6 requirements that can never be deferred
The regulation names these individually. Most are 1-point items, so Rule 2 alone would have allowed them. They must be met before any conditional status:
- 3.1.20 Verify and control/limit connections to and use of external systems
- 3.1.22 Control CUI posted or processed on publicly accessible systems
- 3.12.4 System Security Plan (SSP)
- 3.10.3 Escort visitors
- 3.10.4 Log physical access
- 3.10.5 Control keys and badges
The System Security Plan is on this list. You cannot defer writing the SSP: without one, an assessment cannot be completed at all.
Rule 4: close everything within 180 days
A conditional status is temporary. The items on the POA&M must be fixed and confirmed by a closeout assessment within 180 days of the conditional status date. For a self-assessment, you perform the closeout the same way you performed the original assessment. If the POA&M is not closed in time, the conditional status expires.
What about Level 1?
Level 1 (the basic safeguarding requirements for Federal Contract Information) allows no POA&M at all. Every Level 1 requirement has to be met. The free Level 1 checker shows where you stand.
What this means for a small shop
- Find your real score first. Guessing high is the expensive mistake.
- Sort your gaps into "must fix first" (5-point, 3-point, and the 6 named items) and "could be deferred".
- Fix the first group before you plan around a conditional status.
- Only then decide which 1-point items you can realistically close inside 180 days.
WorkuGRC does this sorting for you: its gap dashboard marks each gap "Fix first" or "POA&M-eligible" and shows your score against the 88-point minimum. It is a drafting tool, so it shows where you stand on your own answers. It does not decide whether you qualify for any status.
Regulatory status — current as of November 12, 2026
Frequently asked questions
- Can I put every gap on a POA&M and still claim CMMC Level 2?
- No. A Conditional Level 2 status requires a score of at least 88, only 1-point requirements may be deferred (with one exception for non-FIPS-validated encryption), and 6 named requirements may never be deferred. Gaps outside those limits must be fixed first.
- Is multifactor authentication allowed on a POA&M?
- No. Multifactor authentication (requirement 3.5.3) is worth more than 1 point even when partly in place, and the regulation gives it no exception, so it must be fully implemented before a conditional status.
- Can the System Security Plan be on the POA&M?
- No. The System Security Plan (requirement 3.12.4) is one of the requirements the regulation names as never deferrable.
- What happens if I do not close the POA&M in 180 days?
- The conditional status expires. The regulation requires a closeout assessment confirming the items are fixed within 180 days of the conditional status date.
- Does CMMC Level 1 allow a POA&M?
- No. A POA&M is not permitted at Level 1; every Level 1 requirement must be met.
Related
- The CMMC affirmation: who signs, what they attest, and when
- CMMC Level 2 self-assessment checklist
- What is my SPRS score?
- Free SPRS score estimator: 12 questions, no signup
See which of your gaps can be deferred.
Answer plain-English questions and get your self-assessment score, a gap list sorted into fix-first and POA&M-eligible, and draft SSP and POA&M documents. Free.
Start free →Informational only — not a compliance determination, an assessment, or legal advice. Requirements are defined by NIST SP 800-171 Rev 2, NIST SP 800-171A, the DoD Assessment Methodology, and 32 CFR Part 170; always verify against the official publications.