Which CMMC Level 2 requirements can go on a POA&M?

Under 32 CFR 170.21, only requirements worth 1 point in the CMMC scoring methodology, plus CUI encryption (SC.L2-3.13.11) where encryption is employed but isn't FIPS-validated. Six requirements may never go on a Level 2 POA&M: 3.1.20, 3.1.22, 3.12.4 (the System Security Plan), 3.10.3, 3.10.4 and 3.10.5.

What is the 80% rule?

Conditional Level 2 status needs an assessment score of at least 0.8 of the number of Level 2 requirements. With 110 requirements that means at most 22 points deducted for the NOT MET requirements on the POA&M.

How long do I have to close a POA&M?

The closing of the POA&M must be confirmed by a POA&M closeout assessment within 180 days of the Conditional CMMC Status Date, or the Conditional status expires. For a Level 2 self-assessment, the closeout self-assessment is done the same way as the first one, and an affirmation follows it.

What is the CMMC Status Date?

The rule defines it as the date the CMMC Status results are submitted to SPRS (or the CMMC instance of eMASS). The date of a Conditional status stays the CMMC Status Date after a successful closeout; no new date is set.

Does a POA&M mean the requirement counts as met?

No. The scoring rule says a POA&M isn't a substitute for a completed requirement: a requirement that isn't implemented is assessed as NOT MET, whether or not it's on a POA&M.

Is the number the tool shows my SPRS score?

No. It shows only the points the rule deducts for the requirements you picked. A real score comes from assessing every requirement's objectives with evidence. The tool isn't an assessment, an SPRS score or legal advice.

What happens to my answers?

Your picks and your status date stay in your browser tab. If you ask for the PDF, ForgePoint keeps your name, work email, company, the suggested next step and the date in its CRM, not your picks or your date, and the PDF is drawn on request and not kept.

Free tool · about 3 minutes

Which of your gaps can sit on a Level 2 POA&M?

Fewer than you might think. Under the CMMC rule, a Plan of Action and Milestones (POA&M) can hold only 1-point requirements, six requirements can never go on it, the points deducted can't exceed 22 of 110, and it has to be closed out within 180 days. Tick the requirements you expect to be NOT MET and see where you stand.

Your answers stay in your browser. Nothing is sent unless you ask for the PDF.

The rules behind the checker · 32 CFR 170.21 and 170.24 · as of Nov 5, 2026

What the CMMC rule says about POA&Ms

In plain words, from the rule's POA&M section and its scoring methodology.

Conditional Level 2 status (self-assessment or C3PAO) is possible only if the assessment score divided by the number of Level 2 requirements (110) is at least 0.8: at most 22 points can be deducted. (32 CFR 170.21(a)(2)(i))
Only requirements worth 1 point may go on the POA&M, with one exception: CUI encryption (SC.L2-3.13.11) may, if encryption is employed but isn't FIPS-validated (3 points). (170.21(a)(2)(ii))
Six requirements may never go on a Level 2 POA&M: external connections (3.1.20), control of public information (3.1.22), the System Security Plan (3.12.4), escorting visitors (3.10.3), physical access logs (3.10.4) and managing physical access devices (3.10.5). (170.21(a)(2)(iii))
The POA&M must be closed out, confirmed by a POA&M closeout assessment, within 180 days of the Conditional CMMC Status Date, or the Conditional status expires. For a self-assessment the closeout is done the same way as the first one. (170.21(b))
A POA&M isn't a substitute for a completed requirement: a requirement that isn't implemented is assessed as NOT MET, whether or not it's on a POA&M. (170.24(c)(2)(i)(B)(6))
Points: 5 for requirements that could lead to significant exploitation of the network or exfiltration of CUI, 3 for a specific and confined effect, 1 for the rest. MFA (3.5.3) is 3 if used only for remote and privileged users and 5 if not used at all; FIPS encryption (3.13.11) is 3 if encryption isn't FIPS-validated and 5 if there's none. (170.24(c)(2))

Sources

Questions

CMMC POA&Ms, answered

Which CMMC Level 2 requirements can go on a POA&M?: Under 32 CFR 170.21, only requirements worth 1 point in the CMMC scoring methodology, plus CUI encryption (SC.L2-3.13.11) where encryption is employed but isn't FIPS-validated. Six requirements may never go on a Level 2 POA&M: 3.1.20, 3.1.22, 3.12.4 (the System Security Plan), 3.10.3, 3.10.4 and 3.10.5.
What is the 80% rule?: Conditional Level 2 status needs an assessment score of at least 0.8 of the number of Level 2 requirements. With 110 requirements that means at most 22 points deducted for the NOT MET requirements on the POA&M.
How long do I have to close a POA&M?: The closing of the POA&M must be confirmed by a POA&M closeout assessment within 180 days of the Conditional CMMC Status Date, or the Conditional status expires. For a Level 2 self-assessment, the closeout self-assessment is done the same way as the first one, and an affirmation follows it.
What is the CMMC Status Date?: The rule defines it as the date the CMMC Status results are submitted to SPRS (or the CMMC instance of eMASS). The date of a Conditional status stays the CMMC Status Date after a successful closeout; no new date is set.
Does a POA&M mean the requirement counts as met?: No. The scoring rule says a POA&M isn't a substitute for a completed requirement: a requirement that isn't implemented is assessed as NOT MET, whether or not it's on a POA&M.
Is the number the tool shows my SPRS score?: No. It shows only the points the rule deducts for the requirements you picked. A real score comes from assessing every requirement's objectives with evidence. The tool isn't an assessment, an SPRS score or legal advice.
What happens to my answers?: Your picks and your status date stay in your browser tab. If you ask for the PDF, ForgePoint keeps your name, work email, company, the suggested next step and the date in its CRM, not your picks or your date, and the PDF is drawn on request and not kept.

Where it leads

Level 2 Readiness Assessment

A list you pick yourself is a starting point. The Level 2 Readiness Assessment confirms what is really NOT MET, with evidence, and gives you a roadmap; the SSP & POA&M Buildout can follow to write the System Security Plan and the POA&M. Already holding Conditional status? The Fractional CMMC Program Lead runs the POA&M every month until closeout. See the Level 2 Readiness Assessment → SSP & POA&M Buildout →