CMMC Level 2 POA&M Explained: Scoring, What Qualifies & How to Close It Out

In our series of posts on CMMC Level 2 compliance, we have talked about scoping, cloud strategy, and assessments. Once you do all the hard work, the final step is certification. One potential outcome of a CMMC certification assessment is a conditional certification. This means that you passed the assessment without clearing all 110 NIST SP 800-171 R2 requirements. A key component of conditional certification is a Plan of Action and Milestones (POA&M), which is a documented plan for fixing practices that were not met during your assessment. There is a lot of nuance around a POA&M that is important to understand, especially the rules for what qualifies.

In our recent CMMC Level 2 webinar, Joe Kurlanski of Monarch ISG, a certified C3PAO, and Brian Brunelle, GraVoc’s Director of Information Security shared how CMMC POA&Ms work, what can and can’t go on a POA&M, and how to keep your POA&M small or avoid one entirely.

Key takeaways

• You can pass a CMMC Level 2 assessment without a perfect score. A conditional certification with a POA&M lets you close a small number of gaps after your assessment.
• You need at least 88 points to qualify for a POA&M. A high score alone isn't enough, because only 1-point requirements can go on it.
• You have 180 days to close out your POA&M. If you miss the deadline, your conditional status expires and you start over.
• Closing the POA&M doesn't extend your certification. Your final certification keeps the date of your original conditional certification.
• A gap assessment is the best way to keep your POA&M small. It finds the gaps you can't defer while you still have time to fix them.
• If you want the bigger picture first, start with our CMMC Level 2 compliance guide.

What is a POA&M in CMMC Level 2?

A POA&M supports conditional CMMC certification and serves as a documented remediation plan for correcting unmet, non-critical requirements. All items on a POA&M must be resolved within 180 days; failure to close out these gaps will result in a failed assessment. One thing to note is that with a conditional certification, you are allowed to bid for defense contracts while addressing compliance gaps in the 180-day period.

How does CMMC Level 2 POA&M scoring work?

CMMC Level 2 scoring starts at 110, which means all requirements are met and you are in the green. If you don’t meet a requirement, its point value is deducted from your total score. Requirements are 1, 3, or 5 points based on their security impact. 2 requirements can be partially effective even if not fully implemented so the deduction varies.

• 3 points are subtracted from the maximum score if MFA is implemented only for remote and privileged users. 5 points are subtracted if MFA is not implemented for any users.
• If encryption is employed, but is not FIPS-validated, 3 points are subtracted from the maximum score; if encryption is not employed, 5 points are subtracted.

To qualify for a conditional certification and POA&M, you need to meet certain criteria as explained in 32 CFR 170.21. The first is simple: you need to score a minimum of 88 out of 110 in your CMMC assessment. Now, here is where it gets confusing: you are only allowed to have unmet requirements that are worth 1 point. Barring exceptions, if you have a 3 or 5-point deduction, you cannot put that on a POA&M for a conditional certification.

As Joe explains in the webinar, this means that even if you have a high score of 105 or 107, you can still fail the assessment and be ineligible for a POA&M if you have any 3 or 5-point deductions.

Which CMMC Level 2 security requirements are allowed to have a POA&M?

The basic rule is that only CMMC Level 2 requirements worth 1 point are allowed to have a POA&M. However, there is an exception: CUI encryption may be included on a POA&M if encryption is employed but it is not FIPS-validated.

None of the following security requirements can be included in the POA&M, even though some are only worth one point:

• AC.L2-3.1.20 External Connections (CUI Data).
• AC.L2-3.1.22 Control Public Information (CUI Data).
• CA.L2-3.12.4 System Security Plan.
• PE.L2-3.10.3 Escort Visitors (CUI Data).
• PE.L2-3.10.4 Physical Access Logs (CUI Data).
• PE.L2-3.10.5 Manage Physical Access (CUI Data).

As Joe points out, for instance, AC.L2-3.1.22 is a one-point practice, but since it cannot go on a POA&M, you could score a 109 out of 110 and still fail the assessment if that requirement is unmet.

How to close out a POA&M?

Once you get a conditional certification, you have 180 days to close out your POA&M. If you miss this deadline, your certification expires and you have to start over.

The POA&M closeout assessment must be performed by a certified C3PAO. It doesn’t have to be the same one that performed your initial CMMC certification assessment. During the assessment, the C3PAO will only review the unmet requirements. As Joe explains, “When you have corrected those deficiencies, you come back to your C3PAO. Actually, it doesn't even have to be the C3PAO you used. You could go to another one… but mostly we are just going to be looking at that unmet practice, saying, that’s now met, and we can convert your conditional to a final."

One thing to note is that a conditional certification does not extend your clock. Once you close out the POA&M and get awarded the final certification, it will be valid for 3 years from the date of the original conditional certification.

How to keep your POA&M small or avoid one entirely?

The best time to deal with POA&M items is before an assessor finds them. A CMMC gap assessment shows you every unmet practice ahead of time. It's especially useful for spotting the 3- and 5-point practices and Level 1 gaps that can’t be put on a POA&M for a conditional certification. From there, a mock assessment can test whether your fixes will hold up the way a C3PAO will evaluate them.

See our breakdown of CMMC Level 2 mock vs. gap assessments for how the two work together.