The most common CMMC mistakes are scoping the whole company instead of the CUI boundary, skipping the system security plan, assuming a POA&M can hold any gap, overlooking cloud and service providers, and treating the annual affirmation as paperwork. Each one is visible in the text of 32 CFR Part 170.
1. Scoping everything
Without a boundary, every laptop, SaaS tool and network segment becomes a candidate for assessment. The rule sorts assets into CUI Assets, Security Protection Assets, Contractor Risk Managed Assets, Specialized Assets and out of scope assets, and you must be ready to justify any asset you call out of scope. Decide the boundary early, and consider a dedicated environment for CUI.
2. No system security plan
CA.L2-3.12.4, the system security plan requirement, is on the list of requirements that may not be placed on a POA&M. Without a plan you cannot reach Conditional status at all. Write the plan as a living document that describes how each requirement is met, with the inventory and network diagram attached.
3. Misunderstanding the POA&M
Many teams think they can pass with open items and fix them later. The rules are narrower. For Level 2, Conditional status needs a score ratio of at least 0.8. No open item may carry more than one point, with a single exception for CUI encryption when encryption is used but not FIPS validated. Several named requirements, including external connections, control of public information, the system security plan and certain physical access items, cannot be open. And you have 180 days to close out, or the Conditional status expires. Level 1 allows no POA&M at all.
4. Treating encryption as a checkbox
SC.L2-3.13.11 on CUI encryption is worth three points. The exception that lets it sit on a POA&M applies only when encryption is used but not FIPS validated. Having no encryption is not covered. Check your tools against validation claims, not marketing pages.
5. Ignoring service providers
Under the scoping tables, a cloud service provider that handles CUI must meet the FedRAMP requirements referenced in DFARS 252.204-7012. A non cloud provider handling CUI is assessed as part of your assessment. You must describe the relationship in the system security plan along with the provider's service description and customer responsibility matrix. Teams often discover this late, when a provider cannot supply the matrix.
6. Thinking self assessment means light assessment
In the phase in text, Level 2 self assessment is an allowed route for some contracts. It still requires scoring under the CMMC scoring methodology, an SPRS entry with the level, status date, scope, CAGE codes and score, and an affirmation. Retain assessment artifacts for six years. Do the work as if an outside assessor were reading it, because DoD can run its own assessment and its results take precedence.
7. Forgetting the annual affirmation
An Affirming Official, a senior person with authority, affirms continuing compliance after each assessment and annually after the Final status date. The statement says you have implemented and will maintain all applicable requirements across your scope. Missing it, or signing without checking, creates a risk to eligibility and a record you may regret.
8. Overlooking Level 1 until the end
If your contracts involve only FCI, Level 1 applies, with 15 practices and no POA&M. Teams chasing Level 2 forget to confirm which contracts need which level. Read each clause.
9. Building evidence once
Evidence goes stale. Assessors look for current proof across the whole scope. Set owners and a calendar for evidence refresh, and tie change control to the system security plan.
What to do
- Read every contract clause and note the required level.
- Define the CUI boundary and tag assets by 170.19 category.
- Write the system security plan before anything else.
- Score yourself honestly against all requirements.
- Check FIPS validation claims for encryption in use.
- Collect service descriptions and responsibility matrices from every provider.
- Name an Affirming Official and calendar the affirmation.
- Build an evidence refresh schedule.
Quick check
Can a POA&M hold any failed requirement?
No. There is a minimum score ratio of 0.8, a point limit per item, a list of requirements that cannot be open, and a 180 day closeout window.
Is there a POA&M for Level 1?
No. The rule says a POA&M is not permitted at any time for Level 1 self assessments.
How Safeguard helps automate this
Several of these mistakes come from evidence that was never collected or went stale. Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, so evidence is collected from connected systems and code instead of by screenshot, and monitoring runs between assessments so your team can focus on other work. Technical evidence comes from your real code and dependencies through scans, SBOMs and reachability. The agent can open tested fix pull requests, but it is off by default, every category starts on Manual, and you choose which run automatically. Safeguard helps prepare and keep evidence ready; an authorized or accredited assessor performs the assessment. Book a call.
Sources
Last reviewed: 18 October 2026.
