Under 32 CFR 170.21, a CMMC Level 2 or Level 3 assessment needs a score ratio of at least 0.8 before any open items can sit on a plan of action and milestones (POA&M). Even then, only low value items qualify, and the POA&M must be closed within 180 days or the conditional status expires.
The score floor
The regulation says Level 2 and Level 3 require a score ratio greater than or equal to 0.8 to use a POA&M. Level 1 never allows one. So you cannot pass with a long list of promises. You have to implement most requirements first.
What may go on a POA&M
For Level 2, no requirement worth more than 1 point may be included. There is one exception: SC.L2-3.13.11, CUI encryption, may be listed if encryption is used but is not FIPS validated, even though that requirement carries 3 points.
Some requirements may never be on a POA&M at Level 2. The regulation names these: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5.
Level 3 has its own banned list: IR.L3-3.6.1e, IR.L3-3.6.2e, RA.L3-3.11.1e, RA.L3-3.11.4e, RA.L3-3.11.6e, RA.L3-3.11.7e and SI.L3-3.14.3e.
The 180 day clock
The POA&M must be closed through a closeout assessment within 180 days of the Conditional CMMC Status Date. If it is not, the conditional status expires. For a Level 2 self-assessment, NOT MET items need remediation and a closeout self-assessment posted to SPRS in that window. For a C3PAO assessment, the closeout is done by a C3PAO.
Planning around it
- Score yourself early against the full requirement list.
- Sort gaps by point value. Anything worth 3 or 5 points must be fixed before assessment.
- Check each gap against the banned lists.
- For items that qualify, write milestones and owners that fit inside 180 days.
- Keep evidence of the fix as you go, since the closeout needs it.
Do not plan to use the POA&M as a place to park hard work. The clock is short and the status disappears when it runs out.
Evidence and tooling
Safeguard's compliance and evidence automation can keep the proof for each remediation next to the requirement it closes, and its policies and gates can hold a control in place after the fix. It does not decide scores and it does not grant a CMMC status.
Quick check
Can a Level 1 self-assessment use a POA&M?
No. The regulation says Level 1 self-assessments never permit one.
What happens if the 180 days pass?
The conditional CMMC status expires.
Sources
Last reviewed: 19 October 2026.
