12.2 Level 2 POA&M Rules, Exclusions & 180-Day Closeout

12.2 Level 2 POA&M Rules, Exclusions & 180-Day Closeout

A Plan of Action and Milestones does not excuse an unmet CMMC requirement. Under 32 CFR §170.21, it can support Conditional status only when the initial result satisfies the exact threshold and every remaining requirement is eligible. Final status requires successful closeout.

Threshold

For Level 2 Self and Level 2 C3PAO, the assessment score divided by the total number of Level 2 requirements must be at least 0.8. With 110 requirements this is commonly described as at least 88, but the regulation states a ratio. It is not “80% of controls implemented,” because the score is weighted and assessment objectives are not separately scored.

The ratio is necessary but not sufficient. Every NOT MET requirement must also pass the point-value and named-exclusion tests.

Point-value rule and exception

A Level 2 POA&M generally cannot include a requirement worth more than one point under the CMMC Scoring Methodology. Ordinary three- and five-point items are excluded.

One narrow exception applies to SC.L2-3.13.11, CUI Encryption when encryption is employed but is not FIPS validated. The resulting deficiency may be placed on the POA&M if all other conditions are satisfied. The exception does not apply when CUI is simply unencrypted and does not create a general cryptography waiver.

Six categorically excluded requirements

The following may not be placed on a Level 2 POA&M:

1. AC.L2-3.1.20 — External Connections (CUI Data)
2. AC.L2-3.1.22 — Control Public Information (CUI Data)
3. CA.L2-3.12.4 — System Security Plan
4. PE.L2-3.10.3 — Escort Visitors (CUI Data)
5. PE.L2-3.10.4 — Physical Access Logs (CUI Data)
6. PE.L2-3.10.5 — Manage Physical Access (CUI Data)

This corrects the false shortcut that all one-point requirements are eligible. Check both point value and the named list.

Other levels

Level 1 permits no POA&M. All 15 requirements must be MET.

Level 3 has its own threshold and barred enhancements: IR.L3-3.6.1e, IR.L3-3.6.2e, RA.L3-3.11.1e, RA.L3-3.11.6e, RA.L3-3.11.7e, RA.L3-3.11.4e, and SI.L3-3.14.3e. Do not import the Level 2 list into Level 3.

The POA&M record

A defensible record identifies each eligible requirement, deficiency, owner, planned action, resources, milestones, due date, and expected closeout evidence. It cannot add newly discovered requirements later to broaden the conditional result. The C3PAO must remain impartial and cannot become the organization's remediation consultant.

The OSC remains responsible for safeguarding CUI and contractual obligations during Conditional status. The Affirming Official submits the status-related affirmation in SPRS. Conditional does not mean the remaining risk can be ignored.

Closeout

Closeout assesses only the NOT MET requirements on the original POA&M and must succeed within 180 days of the Conditional Status Date. For Level 2 Self, the organization performs a closeout self-assessment. For Level 2 C3PAO, an authorized or accredited C3PAO performs the closeout certification assessment. DCMA DIBCAC closes Level 3 POA&Ms.

The assessor verifies every applicable objective for each listed requirement. A completion memo, purchase order, or future plan is insufficient if the mechanism is not implemented and operating. After successful closeout, the status can become Final and the Affirming Official submits the applicable affirmation.

If closeout is not successful within 180 days, Conditional status expires. There is no general administrative extension for an almost-complete item.

Examples

An OSC scores 104 but has CA.L2-3.12.4 NOT MET. Conditional status is unavailable because the SSP requirement is categorically excluded. An OSC scores 100 and uses encryption that is not FIPS validated for SC.L2-3.13.11; the narrow exception may apply if all other conditions are satisfied. An OSC scores 106 with four eligible one-point deficiencies may receive Conditional status, but every item must close within 180 days.

Apply the tests in order: correct score and ratio; point value or the narrow exception; categorical exclusion; accurate record; authorized closeout assessor; and the 180-day deadline.\n\n## Closeout planning controls\n\nA strong closeout plan works backward from day 180 and leaves time for implementation, operational evidence, scheduling, reassessment, QA, and reporting. The OSC should not schedule completion on day 179 and assume a purchase receipt proves operation. The C3PAO also must preserve independence: it may explain the unmet objective and closeout process, but it cannot select the OSC's design or implement the fix. Any change that alters the assessment scope or introduces a provider must be evaluated explicitly rather than treated as a simple POA&M checkbox. The authoritative status date—not a project-plan date—starts the regulatory window.