The Conditional Level 2 check
32 CFR 170.21(a)(2) sets the POA&M conditions for a Conditional Level 2 status. 32 CFR 170.24(c)(2)(i)(B)(6) adds that every NOT MET requirement needs a POA&M line. The check below uses today's score, not the after-closeout score: closing items later does not change the score at assessment.
The check covers the score ratio, list coverage and eligibility rules described above. The score and findings themselves come from a self-assessment or a C3PAO assessment; this page applies the rules to the answers saved in the calculator.
Open requirements
Only scored gaps appear here. 3.12.4 (System Security Plan) is not scored; if it is missing, the assessment cannot be completed, so it is not a POA&M item. The Open pts column is the score gap: for a partially met 3.5.3 or 3.13.11 it is 2 (5 − 3), even though the requirement's point value is 3.
| Requirement | Family | Open pts | Today | POA&M | After closeout |
|---|
The rules the selector applies
| Rule | What it means here | Source |
|---|---|---|
| Score ratio | Today's score ÷ 110 must be at least 0.8. With 110 requirements, that is 88. | 32 CFR 170.21(a)(2)(i) |
| Point value | No POA&M item may have a point value greater than 1. The one exception is SC.L2-3.13.11 at 3 points when encryption is employed but is not FIPS-validated. | 32 CFR 170.21(a)(2)(ii) |
| Excluded requirements | These six may not be on the POA&M: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4, PE.L2-3.10.5. | 32 CFR 170.21(a)(2)(iii) |
| Every NOT MET requirement | Each NOT MET requirement needs a POA&M line; a POA&M is not a substitute for meeting it. | 32 CFR 170.24(c)(2)(i)(B)(6) |
| Closeout window | The POA&M closeout assessment must happen within 180 days of the Conditional CMMC Status Date. If it does not, the conditional status expires. | 32 CFR 170.21(b) |
The data model flags 47 requirements as POA&M-eligible; 3.13.11 is only selectable here when its status is partial — the 3-point case. At 5 points it is an ineligible, full-deduction item.
Rules checked 2026-10-30 against 32 CFR 170.21 and 32 CFR 170.24.
POA&M questions
Does putting a control on a POA&M change today's SPRS score?
No. The score at assessment reflects every requirement that is NOT MET. 32 CFR 170.24(c)(2)(i)(B)(6) says a POA&M is not a substitute for a completed requirement. A POA&M changes the later score when the items are completed and a closeout assessment confirms it.
Can a 5-point control go on a CMMC Level 2 POA&M?
No, except SC.L2-3.13.11, which may be included at 3 points when encryption is employed but is not FIPS-validated. 32 CFR 170.21(a)(2)(ii) otherwise limits POA&M items to a point value of 1.
What happens if the POA&M is not closed within 180 days?
The Conditional CMMC Status expires. 32 CFR 170.21(b) requires a POA&M closeout assessment within 180 days of the Conditional CMMC Status Date.
Can I put only some open requirements on the POA&M?
Every NOT MET requirement needs a POA&M line under 32 CFR 170.24(c)(2)(i)(B)(6), and a Conditional Level 2 POA&M must meet the 170.21(a)(2) conditions. If any open requirement is not POA&M-eligible, conditional status is not available until that requirement is met.
Related: how the 313-point method works · target-score planner · what the score range means · the calculator