The CMMC POA&M: What Can Stay Open and for How Long

What can stay open on a CMMC POA&M, and for how long?

At Level 2, a POA&M may hold only requirements worth 1 point, with one encryption exception, must exclude six named requirements, is available only when the score is at least 80 percent of the maximum, and must be closed and confirmed by a closeout assessment within 180 days of the Conditional status date. All of that is in 32 CFR 170.21. At Level 1, nothing can stay open at all.

That is a far shorter leash than the plans of action most suppliers have kept under DFARS 252.204-7012 since 2017.

The Level 2 rules in one table

Condition	What 32 CFR 170.21 says
Minimum score	Assessment score divided by the number of Level 2 requirements must be 0.8 or higher, which is 88 of 110 per the rule's formula
Point value of open items	No requirement on the POA&M may be worth more than 1 point under the 170.24 scoring method
The one exception	SC.L2-3.13.11 CUI Encryption may stay open at 3 points if encryption is in place but not FIPS-validated
Never on the POA&M	AC.L2-3.1.20 External Connections, AC.L2-3.1.22 Control Public Information, CA.L2-3.12.4 System Security Plan, PE.L2-3.10.3 Escort Visitors, PE.L2-3.10.4 Physical Access Logs, PE.L2-3.10.5 Manage Physical Access
Time limit	Closeout confirmed within 180 days of the Conditional CMMC Status Date, or Conditional status expires
Who confirms closeout	The supplier itself for a self-assessment; an authorized C3PAO for a certification assessment

Read the second row twice. Every 5-point and 3-point requirement except the encryption case must be Met before you can hold Conditional status. MFA, audit logging, incident response: none of these can wait.

Why the rule is built this way

The scoring method in 170.24 weights each requirement by the damage its absence invites. A 5-point requirement "could lead to significant exploitation of the network, or exfiltration of CUI" in the rule's words. The Department will tolerate a short delay on items with "a limited or indirect effect", and none on the ones that stop an intrusion.

The six excluded requirements are a different logic. Four are physical or boundary controls that are cheap to do and hard to excuse. One is the SSP, without which no assessment can be completed. One is the control of public information, a process rather than a purchase.

Where the 180 days go

The clock starts on the Conditional status date and ends when a closeout assessment confirms every item is closed. For a self-assessment, you run the closeout yourself. For a certification assessment, when that requirement returns, a C3PAO runs it.

A workable split for a 30-person supplier:

1. Days 1 to 30: order anything that needs buying. Procurement lead time is the usual reason an item is still open on day 170.
2. Days 31 to 120: close the items, collecting evidence as each one closes.
3. Days 121 to 150: internal review of every closed item against its assessment objectives.
4. Days 151 to 180: the closeout assessment itself, with slack for a finding.

Our readiness timeline is built so you arrive at the first assessment with a POA&M the rule allows.

The POA&M you keep anyway

Separately, NIST SP 800-171 requirement 3.12.2 asks you to maintain plans of action for deficiencies as an ongoing practice. That document can hold anything, because it is a management record, not a status claim. 170.24 even treats a temporary deficiency addressed in an operational plan of action with progress shown as Met.

So you will have two things with the same name. The operational POA&M is a living list of what you are improving. The CMMC POA&M is the narrow set of 1-point items you may carry into Conditional status. Keep them in one file if you like, but label the columns.

What this means for the score you post

A POA&M item is still Not Met for scoring. If you hold three 1-point items and the encryption exception, your SPRS score is 110 minus 6, which is 104, and that is the number to post per the CMMC scoring method. How to calculate your SPRS score honestly covers the arithmetic and why an inflated number is a legal problem.

Where the program stands

Phase 1 self-assessments have appeared in solicitations since 10 November 2025. Phase 2 third-party assessments were suspended on 13 July 2026, and the class deviation of 3 September 2026 removes the C3PAO requirement from contracts for now, with no end date and no repeal. DFARS 252.204-7012, NIST SP 800-171 Rev 2, SPRS scores and the 72-hour incident report still apply. AccuSights is not a C3PAO.

During the pause, the self-assessment POA&M rules in 170.21 are the ones that matter. Level 1 vs Level 2 explains why a Level 1 supplier has no POA&M to manage at all, and the NIST SP 800-171 framework page lists the requirements by family.

Where AccuSights fits

We write the POA&M to the rule, with the point value and the closeout date on every line, and we run the mock assessment that shows what the real one will find, with a named engineer and a fixed fee in writing within 24 hours of the intake form. We are not a C3PAO. Start on the CMMC framework page or book a free Risk Diagnosis and we will tell you what on your current plan the rule will not let you keep.