POA&M Rules Under 32 CFR 170.21: The One-Point Rule, 180 Days and What Happens After

What a POA&M is for

In everyday security work a plan of action and milestones is any list of open weaknesses with owners and dates. In the CMMC program it has a stricter meaning. Section 170.21(a) says that, to achieve a Conditional CMMC Status, an organization seeking assessment is only permitted to have a POA&M for select requirements scored NOT MET during the assessment, and only under stated conditions. It is a short bridge from a nearly passing result to a passing one, not a place to park a long to-do list.

Level 1: not allowed

Section 170.21(a)(1) is blunt: a POA&M is not permitted at any time for Level 1 self-assessments. All Level 1 requirements must be fully implemented. Section 170.24 says the same for scoring, where Level 1 results are MET or NOT MET in their entirety.

Level 2: three conditions, all required

For Level 2, whether it is a self-assessment or a certification assessment by a C3PAO, the contractor can reach Conditional Level 2 only if all of these are true:

• The score condition. The assessment score divided by the total number of Level 2 security requirements is greater than or equal to 0.8. There are 110 Level 2 requirements and the maximum score is 110, so you need at least 88. Eighty percent is a floor, not a target.
• The point-value condition. None of the requirements on the POA&M may have a point value greater than 1 under the scoring methodology in 170.24. In that methodology most requirements are worth 1 point, and some are worth 3 or 5, so those higher-value items must be fully met on the day. This is the 1-point rule.
• The exclusion list. None of six named requirements may be on the POA&M, whatever their point value.

The one exception to the 1‑point rule

The rule makes one exception. SC.L2-3.13.11, CUI Encryption, may be on a POA&M if encryption is employed but is not FIPS-validated. In that case the requirement scores a point value of 3 instead of the full 5, and the rule allows it to be listed. The exception exists because the gap is in the validation status of the module, not in whether encryption is used at all. If no encryption is used for CUI at all, that is a different result and the exception does not apply. For how to read the validation list, see our article on FIPS 140-2 and 140-3 validated modules.

The six requirements that can never be on a POA&M

These are the requirements the rule keeps off the list entirely:

• AC.L2-3.1.20, External Connections (CUI Data).
• AC.L2-3.1.22, Control Public Information (CUI Data).
• CA.L2-3.12.4, System Security Plan.
• PE.L2-3.10.3, Escort Visitors (CUI Data).
• PE.L2-3.10.4, Physical Access Logs (CUI Data).
• PE.L2-3.10.5, Manage Physical Access (CUI Data).

The system security plan is on this list, which means a missing or inadequate plan cannot be deferred. Several of the physical protection requirements are on it too.

Level 3 in one paragraph

Section 170.21(a)(3) sets a similar score floor of 0.8 for Level 3 and bans seven Level 3 requirements, including the security operations center and cyber incident response team items and several supply chain and threat-informed risk assessment items. Most small contractors need Level 2, so we focus there.

The 180‑day closeout

Section 170.21(b) defines a POA&M closeout assessment as a CMMC assessment that assesses only the NOT MET requirements that were identified with a POA&M in the initial assessment. The closing of the POA&M must be confirmed by that closeout assessment within 180 days of the Conditional CMMC Status Date. Who performs it depends on the level:

• Level 2 self-assessment: the contractor performs the closeout self-assessment in the same manner as the initial one.
• Level 2 certification assessment: an authorized or accredited C3PAO must perform the closeout, and under 170.17 the C3PAO must post the results in eMASS within the 180 days.
• Level 3: the Defense Contract Management Agency's DIBCAC performs it.

What happens if the POA&M is not closed

Section 170.21(b) says that if the POA&M is not successfully closed out within 180 days, the Conditional CMMC Status for the information system expires. For a Level 2 certification assessment, 170.17(a)(1)(ii)(B) adds the consequences: if the Conditional Level 2 (C3PAO) status expires within the period of performance of a contract, standard contractual remedies apply, and the contractor is ineligible for additional awards with a Level 2 (C3PAO) or higher requirement for that information system until a new status is achieved.

The practical reading is that the clock is short and fixed. Plan closeout work before you take the assessment, not after, and keep the fixes inexpensive: items that need new hardware, a long procurement or a cloud migration are poor candidates for a 180‑day bridge.

A planning checklist

• Score yourself with the 170.24 methodology and mark every NOT MET item with its point value.
• Check each against the 1-point rule and the six excluded requirements. Fix anything that fails either test before the assessment.
• If encryption is the gap, check whether the modules in use are FIPS-validated and whether validation status can be fixed within 180 days.
• For each POA&M item, write the fix, the owner, the evidence you will present and a date well inside the 180 days.
• Remember that a temporary deficiency handled in an operational plan of action with reviews and progress can be assessed as MET under 170.24; that is a different thing from a POA&M under 170.21, and the two should not be confused.

We help defense subcontractors score themselves honestly, decide what can sit on a POA&M and what must be fixed first, and build the closeout evidence.

Sources

• 32 CFR 170.21, Plan of Action and Milestones requirements (eCFR)
• 32 CFR 170.17, Level 2 certification assessment and affirmation (eCFR)
• 32 CFR 170.24, CMMC Scoring Methodology (eCFR)
• 32 CFR 170.16, Level 2 self-assessment and affirmation requirements (eCFR)
• 32 CFR 170.15, Level 1 self-assessment and affirmation requirements (eCFR)

This article is general information, not legal, contracting or technical advice for your environment. Contract clauses, DoD policy and certification rules are set by the Department of Defense and your contract; check what applies to you with your prime, your contracting officer and counsel. Last reviewed November 9, 2026.

Next article

Next · InfrastructureWi-Fi Segmentation for Small Offices: Guest, IoT and Staff Networks, WPA3 and IsolationOne Wi-Fi network for staff, visitors, printers and thermostats means any one of them can reach all the others. Splitting it into a few separate networks is one of the cheapest security improvements a small office can make. This guide covers what to separate, how to set encryption, what client isolation does and where to put the management network.7 min read

Related reading

• RegulationK-12 Student Data Security: FERPA, COPPA and CIPA in Plain Words, and How to Vet an Edtech Vendor8 min
• RegulationWhat a CMMC Level 2 Assessor Examines, Asks and Tests: Evidence and Six-Year Retention9 min