POA&Ms under CMMC: what can stay open at assessment. (Hint: very little.)

The escape hatch you remember doesn't exist anymore

Under self-attestation, a POA&M could carry almost anything for almost any length of time. You scored yourself, you listed your gaps, and the plan itself was the compliance artifact. Contractors built entire bidding strategies on that flexibility — and plenty of POA&Ms celebrated birthdays.

The CMMC final rule replaces that world with something much narrower. A POA&M still exists at Level 2, but it's no longer a parking lot for hard problems. It's a short runway for small ones, with a hard fence around what qualifies and a clock running the moment you're assessed.

The actual rules, in one place

Under the final rule, a Level 2 assessment can produce a Conditional certification with a POA&M only if all of the following hold:

You score at least 88. The threshold is 0.8 × 110 = 88. Below that, there is no conditional status — you simply didn't pass, POA&M or not.

Only limited, low-weight gaps may stay open. Only 1-point requirements are POA&M-eligible. No 5-point requirement may appear on the POA&M, and select requirements are never POA&M-eligible regardless of weight. The heavy controls have to be done before the assessor walks in.

The clock is 180 days — and it's verified. Everything on the POA&M must be closed within 180 days, confirmed by a POA&M closeout assessment. You don't self-declare the items closed; someone checks. Miss the window and the conditional status lapses — which means the certification you were counting on for contract eligibility goes with it.

Put those three conditions together and the shape of the new POA&M becomes clear: it exists to let a fundamentally finished program carry a few small, verifiable loose ends across the finish line — nothing more.

	Old world (self-attestation)	CMMC Level 2 certification
POA&M allowed?	Yes — essentially open-ended, any gap	Limited 1-point items only; no 5-pointers; some requirements never eligible
Minimum score	None — any score could sit in SPRS with a plan	88 of 110 (0.8 × 110)
Closeout deadline	Whatever date you wrote down	180 days, or conditional status lapses
Verification	Self-attested	POA&M closeout assessment

The practical translation

Strip away the rule citations and the message is blunt: walk into your assessment at 88 or better with nothing but a handful of 1-pointers left — or don't walk in yet. A conditional certification is a real outcome, but it's a narrow one, and it comes with a six-month sprint attached. It is not a strategy; it's a margin for the last few small items.

If you're not sure which of your open gaps are 5-point, 3-point, or 1-point items, that's the first thing to fix — the weights come from the same methodology we broke down in our SPRS scoring explainer, and the free CMMC Calculator will classify every one of your gaps by weight and show you exactly how far from 88 you're standing.

What this does to your sequencing

The rule has a direct scheduling consequence: close your 5-point and 3-point gaps before you book the C3PAO, because none of them can ride the POA&M. The temptation is to schedule the assessment as a forcing function and clean up in flight. Under these rules, that's how you pay for an assessment you can't pass — a 5-point gap discovered during assessment week isn't a POA&M entry, it's a failed requirement.

The sequencing that actually works: knock down the heavy-weight items first, burn the 3-pointers next, and only then decide whether the remaining 1-pointers are worth carrying into assessment as POA&M candidates or worth simply finishing. Our CMMC Deadline Playbook lays out that sequence against the phase-in timeline, and a gap assessment will tell you which side of 88 you're really on before anyone with a clipboard does.

The old world rewarded a well-written plan. The new one rewards a finished implementation with a short, boring POA&M — or none at all.