Key takeaways
- Conditional Level 2 status requires a score of at least 88 of 110 under 32 CFR 170.21.
- Only 1-point requirements, plus CUI encryption that is not FIPS-validated, may be placed on a CMMC POA&M.
- Six requirements, including the system security plan and three physical access controls, can never be on a POA&M.
- A POA&M closeout assessment must confirm the open items within 180 days, or the Conditional status expires.
- The July 2026 Phase 2 suspension paused C3PAO requirements in solicitations but left the POA&M rules unchanged.
What is conditional CMMC certification?
Conditional CMMC status is a temporary status that lets a contractor with a few low-weight gaps meet a CMMC requirement while it closes them under a plan of action and milestones (POA&M). For an architecture, engineering or construction firm handling CUI drawings and specifications on a defense project, it can decide whether the firm stays eligible for the next award. The rule defines two Level 2 versions: Conditional Level 2 (Self), from a self-assessment, and Conditional Level 2 (C3PAO), from a certification assessment by a third-party assessment organization. 32 CFR 170.21 sets the terms for both, and the terms are narrow.
A POA&M does not raise the score. Under 32 CFR 170.24, a POA&M "is not a substitute for a completed requirement." An item on the POA&M is still scored NOT MET until it is fixed and reassessed.
Which gaps can go on a CMMC POA&M?
Only 1-point requirements can go on a CMMC Level 2 POA&M, plus CUI encryption that is in place but not FIPS-validated, and only when the score is at least 88 of 110. Section 170.21(a)(2) requires that the assessment score divided by the number of Level 2 security requirements be at least 0.8. Level 2 covers the 110 requirements of NIST SP 800-171 Rev 2, so the floor is a score of 88.
The encryption exception covers SC.L2-3.13.11, which may go on the POA&M when encryption is in place but not FIPS-validated, a 3-point deduction. Six requirements can never be on a POA&M, whatever their weight:
- AC.L2-3.1.20, external connections
- AC.L2-3.1.22, control of publicly posted information
- CA.L2-3.12.4, the system security plan
- PE.L2-3.10.3, escorting visitors
- PE.L2-3.10.4, physical access logs
- PE.L2-3.10.5, managing physical access devices
Any unmet requirement worth 3 or 5 points rules out conditional status. Multifactor authentication is a common example of a high-weight control: the scoring rules deduct 3 points for IA.L2-3.5.3 if MFA covers only remote and privileged users, and 5 points if it covers no one.
How long is CMMC conditional status valid?
Conditional CMMC status lasts 180 days: a POA&M closeout assessment must confirm every open item within 180 days of the Conditional CMMC Status Date, or the status expires. Section 170.21(b) limits the closeout to the requirements on the POA&M. For Level 2 (Self), the contractor performs the closeout using the same method as the original self-assessment. For Level 2 (C3PAO), an authorized or accredited C3PAO performs it.
Affirmations bracket the window. Under 32 CFR 170.22, the Affirming Official, a senior representative of the company, affirms compliance in the Supplier Performance Risk System (SPRS) on reaching Conditional status, again after the POA&M closeout, and annually after reaching Final status. Each affirmation is a representation to the government, so it should match the evidence.
A passing closeout converts the Conditional status to Final. For Level 2 (Self), 32 CFR 170.16 then requires a new self-assessment, with results posted to SPRS, within three years of the CMMC Status Date, on top of the annual affirmations. Final status can still be overtaken: the same section says a DCMA DIBCAC assessment that finds non-adherence takes precedence over any existing status.
What happens if a CMMC POA&M is not closed in 180 days?
The Conditional CMMC status expires, under 32 CFR 170.21(b). For Level 2 (Self), 32 CFR 170.16 says that if this happens during a contract's period of performance, standard contractual remedies apply, and the contractor cannot receive new awards requiring Level 2 (Self) or higher for the affected systems until it achieves a new status. Section 170.21 does not provide for an extension.
For a firm that depends on defense work, the practical risk is losing eligibility for the next task order or subcontract while the gap is closed and reassessed.
Does the CMMC Phase 2 suspension change the POA&M rules?
No. The Department of War suspended CMMC Phase 2 on July 13, 2026, before its scheduled November 10, 2026 start, and set up a CMMC Reform Task Force to review the program. The announcement said "All Phase I self-assessment requirements remain firmly in place." Contracts that call for Level 2 (Self) still work with Conditional status on the same 180-day clock.
The Cyber AB said at its September 2026 town hall that C3PAOs are still conducting Level 2 certification assessments. Firms that pursue certification anyway, often because a prime contractor still asks for it, face the same conditional terms. The task force's recommendations could change the program, so check for official updates before you plan around today's rules.
For the rest of the program, see our summary of what still applies after the Phase 2 suspension.
What should AEC firms do this quarter?
Treat the 180 days as a backstop and aim to reach the assessment with little or nothing left to defer.
- Score yourself against all 110 requirements and list every NOT MET item with its point value.
- Close every 3-point and 5-point gap first, since none of them can be deferred. Multifactor authentication and FIPS-validated encryption are two to check early.
- Finish the system security plan before any assessment, because CA.L2-3.12.4 can never sit on a POA&M.
- Check physical access controls at every location in scope, including project offices and jobsite trailers where CUI drawings and specifications are handled.
- Give each remaining 1-point item an owner, a budget and a target date well inside 180 days, and book the closeout assessment when you book the original one.
- Read your prime contracts and subcontract flowdowns for the CMMC status they name, and note whether a conditional status satisfies them.
- Brief your Affirming Official on what each SPRS affirmation states and what evidence supports it.
How does s90 help?
s90 helps architecture, engineering and construction firms with defense work get ready for CMMC Level 2: gap scoring against NIST SP 800-171 Rev 2, remediation of high-weight controls such as multifactor authentication and encryption, system security plan support, and evidence collection for assessments and POA&M closeout. If you want to know whether your current score would qualify for conditional status, we can help you find out.
