Conditional CMMC Level 2 status requires an assessment score of at least 88 of 110 and a POA&M containing only eligible unmet requirements. A result below that threshold, or an unmet requirement that cannot go on a POA&M, produces no Conditional CMMC status. Conditional status starts a 180-day closeout window. For Level 2 (Self), the organization performs the closeout self-assessment and enters it in SPRS. A C3PAO performs the closeout certification assessment for its assessment path, and the applicable contract determines whether current status is needed for award or performance.
What counts as a failed Level 2 assessment?
“Fail” is not a single status in the rule. 32 CFR 170.21 sets the two tests for Conditional status: a score of at least 0.8 of the maximum score and only POA&M-eligible unmet requirements. Miss either test and the organization does not receive Conditional status.
| Result | What follows |
|---|---|
| 110, all requirements MET | Final status |
| 88–109, only eligible unmet requirements | Conditional status and a 180-day POA&M closeout |
| Below 88 | No Conditional status. Remediate and obtain a new assessment. |
| Ineligible unmet requirement | No Conditional status, regardless of score |
The Department’s current CMMC page confirms the Level 2 Self threshold and 180-day closeout rule. The applicable contract decides whether a current status is needed for award or performance.
Which gaps cannot go on a POA&M?
The regulation limits POA&Ms. Section 170.21 names six requirements that cannot appear on a Level 2 POA&M: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4, and PE.L2-3.10.5. It also limits POA&M items to one-point requirements, with a specific exception for SC.L2-3.13.11 when encryption is employed but is not FIPS-validated. Read the requirement and the exception before treating a gap as eligible. A consultant’s label does not change the rule.
How does the 180-day closeout work?
The 180 days run from the Conditional CMMC Status Date. The closeout addresses the requirements listed on the POA&M. A Level 2 (Self) closeout is performed by the organization in the same manner as the initial self-assessment and is entered in SPRS. A Level 2 (C3PAO) closeout is performed by a C3PAO. If the organization does not complete the closeout in time, the Conditional status expires.
Start the closeout plan before the initial assessment. Name the owner, evidence, validation method, and due date for each allowed item. A POA&M is a bounded remediation record. It is not a substitute for a working control.
Can you be reassessed after a failed result?
The rule does not establish a cooling-off period for a new assessment. It does allow a C3PAO to conduct a re-evaluation of NOT MET findings within 10 business days of the active assessment when new evidence supports that work. That narrow re-evaluation window differs from a later, new assessment. Ask the assessor which path is available before paying for new fieldwork.
What changed during the 2026 pause?
As of September 30, 2026, DoW says CMMC implementation is paused in Phase 1 and new designations are limited to self-assessments at Levels 1 and 2. The suspension did not remove DFARS 252.204-7012 or the Level 2 POA&M rules. A Level 2 Self closeout therefore matters where a contract requires that status.
Prepare for the assessment that follows
Use the failed finding as a work list. Confirm scope. Repair the underlying practice. Collect evidence from the running system. Then ask whether the evidence supports re-evaluation, closeout, or a new assessment. See how to prepare for a CMMC assessment, a POA&M template, and the CMMC assessment timeline. Deep Fathom can keep the assigned work and evidence together. The assessor decides the result.
Don’t treat a planned control as a completed one. Don’t let a threshold hide an ineligible finding. Review the self-assessment and C3PAO guide before choosing the assessment path.
Sources
| Source | What it supports |
|---|---|
| 32 CFR Part 170 | Conditional threshold, POA&M eligibility, closeout, and re-evaluation rules. |
| DFARS 252.204-7021 | Current status and closeout obligation in a designated contract. |
| DoW CIO, About CMMC | Current Phase I pause and Level 2 Self description. |