POA&Ms under CMMC: what can stay open at assessment. (Hint: very little.)

The escape hatch you remember doesn't exist anymore

Under self-attestation, a POA&M could carry almost anything for almost any length of time. You scored yourself, you listed your gaps, and the plan itself was the compliance artifact. Contractors built entire bidding strategies on that flexibility, and plenty of POA&Ms celebrated birthdays.

The CMMC final rule replaces that world with something much narrower. A POA&M still exists at Level 2, but it is now a short runway for a few small items, with a hard fence around what qualifies and a clock that starts the moment you're assessed.

The actual rules, in one place

Under the final rule, a Level 2 assessment can produce a Conditional certification with a POA&M only if all of the following hold:

You score at least 88. The threshold is 0.8 × 110 = 88. Below that there is no conditional status, and with or without a POA&M, you didn't pass.

Only limited, low-weight gaps may stay open. Only 1-point requirements are POA&M-eligible, with one narrow exception: 3.13.11 (FIPS-validated cryptography) may go on the POA&M when encryption is in place but not FIPS-validated. No other 3-point or 5-point requirement may appear on it, and six requirements are never eligible regardless of weight: 3.1.20, 3.1.22, 3.10.3, 3.10.4, 3.10.5 and 3.12.4. The heavy controls have to be done before the assessor walks in.

The clock is 180 days, and someone checks. Everything on the POA&M must be closed within 180 days and confirmed by a POA&M closeout assessment, so you can't simply declare the items closed. Miss the window and the conditional status lapses, taking with it the certification you were counting on for contract eligibility.

Taken together, the three conditions mean the new POA&M exists for one purpose: letting a program that is essentially finished carry a few small, verifiable loose ends across the finish line.

	Old world (self-attestation)	CMMC Level 2 certification
POA&M allowed?	Yes, essentially open-ended, for any gap	1-point items only, plus 3.13.11 when encryption isn't FIPS-validated; some requirements never eligible
Minimum score	None; any score could sit in SPRS alongside a plan	88 of 110 (0.8 × 110)
Closeout deadline	Whatever date you wrote down	180 days, or conditional status lapses
Verification	Self-attested	POA&M closeout assessment

The practical translation

Walk into your assessment at 88 or better with only a handful of 1-pointers left, or don't walk in yet. A conditional certification is a real outcome, but a narrow one, and it comes with a six-month sprint attached. Use it as a margin for the last few small items and don't build a plan around it.

If you're not sure which of your open gaps are 5-point, 3-point, or 1-point items, find that out first. The weights come from the same methodology we broke down in our SPRS scoring explainer, and the free CMMC Calculator will classify every one of your gaps by weight and show you how far from 88 you're standing.

What this does to your sequencing

The rule changes your schedule: close your 5-point and 3-point gaps before you book the C3PAO, because apart from the 3.13.11 exception, none of them can ride the POA&M. It's tempting to book the assessment as a forcing function and clean up in flight. Under these rules, that's how you pay for an assessment you can't pass, because a 5-point gap discovered during assessment week goes down as a failed requirement with no POA&M option.

The order that works: knock down the heavy-weight items first, burn the 3-pointers next, and only then decide whether the remaining 1-pointers are worth carrying into assessment as POA&M candidates or simply finishing. Our CMMC Deadline Playbook lays out that sequence against the phase-in timeline, and a gap assessment will tell you which side of 88 you're on before anyone with a clipboard does.

A well-written plan used to be enough. What passes now is a finished implementation with a short, boring POA&M, or none at all.