Which Parts of a CMMC POA&M You Can Defer

A Plan of Action and Milestones (POA&M) records security requirements that an organization has not fully met and outlines the steps needed to meet them. Under Cybersecurity Maturity Model Certification (CMMC), a contractor may receive conditional certification while eligible deficiencies are remediated, subject to regulatory requirements.

For contractors preparing for a Level 2 assessment, knowing which deficiencies may qualify for a POA&M and which must be resolved beforehand can prevent surprises during the assessment itself.

Working with a CMMC compliance team before the assessment can help determine which findings are eligible for deferral and which need immediate remediation.

In This Article: CMMC POA&M eligibility rules for Level 2, including which requirements may be deferred, scoring thresholds for conditional certification, POA&M documentation standards, and the 180-day closeout deadline.

CMMC Requirements Eligible for a POA&M

The scoring methodology at 32 CFR 170.24 assigns each of the 110 Level 2 requirements a weighted value of 1, 3, or 5 points (CMMC Scoring Methodology, 2024). Only requirements weighted at 1 point may appear on a POA&M. The 58 requirements that carry 3-point or 5-point values must be fully implemented before the assessment, and 32 CFR 170.21 excludes six additional 1-point requirements by name.

An organization must also meet a minimum scoring threshold before a POA&M is permitted. The assessment score divided by 110 must reach at least 0.8, which means a minimum score of 88. Any requirement placed on the POA&M must carry a 1-point value and must not be one of these exclusions:

• AC.L2-3.1.20 (External Connections) requires organizations to control and verify connections to external systems that process, store, or transmit controlled unclassified information (CUI). It applies to any system boundary where CUI may cross between organizational environments.
• AC.L2-3.1.22 (Control Public Information) governs CUI posted or processed on publicly accessible systems and prevents unintentional disclosure through public-facing platforms.
• CA.L2-3.12.4 (System Security Plan) requires a documented SSP that describes system boundaries, the operational environment, and how security requirements are implemented. Assessors use this document as the baseline for the assessment itself.
• PE.L2-3.10.3 (Escort Visitors) requires visitor escort and activity monitoring in areas where CUI is accessible.
• PE.L2-3.10.4 (Physical Access Logs) requires audit logs of physical access to facilities and systems containing CUI.
• PE.L2-3.10.5 (Manage Physical Access) requires control of physical access devices including keys, badges, and combination locks.

One limited exception applies to SC.L2-3.13.11, which addresses Federal Information Processing Standards (FIPS) validated cryptography. If encryption is deployed for CUI but the cryptographic module has not yet received FIPS validation, this requirement may appear on a POA&M at a 3-point cost. If no encryption is in place, it scores as a 5-point deficiency and cannot be deferred.

CMMC POA&M Requirements for Level 2

Meeting CMMC Level 2 requires satisfying all 110 security requirements from NIST SP 800-171 Rev 2. When an organization has unmet requirements at the time of assessment, the POA&M eligibility of each gap depends on its point category and whether any additional restrictions apply.

Check Whether the Requirement Can Be Deferred

Before placing a requirement on a POA&M, confirm that it carries a 1-point value under the scoring methodology at 32 CFR 170.24. The 44 requirements weighted at 5 points and the 14 weighted at 3 points cannot be deferred (with the sole exception of the FIPS validation rule under SC.L2-3.13.11).

The requirement must also not appear on the list of six named exclusions. Organizations that assume an unmet requirement can remain open without verifying its point value and exclusion status may enter the assessment with a disqualifying deficiency.

Know Which Requirements Cannot Be Deferred

The 58 requirements ineligible for a POA&M span every control family and include many of the practices most central to a security program, including access authorization, multifactor authentication, incident response planning, configuration baselines, and system integrity monitoring. 

Because these carry the highest point values, a single NOT MET finding among them can reduce the score by 3 or 5 points. Addressing these requirements before the assessment protects the organization’s eligibility for conditional status.

How the CMMC POA&M Score Affects Eligibility

Each Level 2 requirement is scored as either MET or NOT MET, with no partial credit. Multifactor authentication (IA.L2-3.5.3) and FIPS-validated encryption (SC.L2-3.13.11) are the two limited exceptions, carrying variable point deductions depending on the degree of implementation (CMMC Scoring Methodology, 2024).

The conditional threshold is a score of at least 88 out of 110. Because only 1-point items may appear on a POA&M, an organization can defer at most 22 eligible requirements before the score falls below that line. A contractor with three or four open 1-point deficiencies has room to work with. An organization with shortfalls spread across multiple point categories faces a different situation, one in which a POA&M is only one part of a larger solution.

Running an internal gap analysis can help project the assessment score and identify deficiencies that threaten eligibility. If the projected score is close to 88, even one unexpected finding during the formal assessment could push it below the threshold.

What to Include in a CMMC POA&M

Each POA&M entry should identify the unmet requirement by practice number and document the specific reason the gap remains open, whether that is a pending technology deployment, a policy revision in progress, or a resource constraint.

Every corrective action needs an assigned owner, a realistic target completion date, and the resources allocated to close the gap. Milestones should be specific enough to track progress. For example, “Implement multifactor authentication for all network access by [date]” is more actionable than “address IA requirements.”

Collect evidence throughout remediation. Configuration exports, updated policies, and test results documented as work progresses are easier to present at closeout than documentation reconstructed after the fact.

The POA&M Closeout Deadline

Every POA&M item must be remediated and verified within 180 calendar days of the Conditional CMMC Status Date. For Level 2 certification assessments, a Certified Third Party Assessment Organization (C3PAO) conducts the closeout assessment. For self-assessments, the organization performs its own closeout and posts the updated results to SPRS.

Planning remediation before the initial assessment leaves more time for technology procurement, configuration, testing, and evidence collection.

If the 180-day window passes without successful closeout, the conditional status expires. The organization does not revert to a lower certification level. It loses CMMC status entirely and must undergo a new assessment. 

Vaultes is a Veteran-owned cybersecurity firm with accreditation as both a CMMC C3PAO and a FedRAMP Third Party Assessment Organization. We work with Defense Industrial Base contractors to assess compliance readiness, identify shortfalls, and build remediation programs that hold up under formal assessment. Request a consultation to discuss where your program stands and what steps come next.