If you cannot find information about a compliance topic, please contact us for free support.
Achieving Conditional CMMC Level 2 Certification with POA&M
Perfect compliance on assessment day is ideal, but not always achievable. CMMC recognizes this reality by allowing conditional Level 2 certification when you meet most—but not all—requirements. Conditional certification provides a path forward while you completethe remaining remediation, but it comes with strict rules and a firm deadline.
CMMC stands for Cybersecurity Maturity Model Certification—the DoD’s mandatory cybersecurity program for defense contractors.
POA&M stands for Plan of Action and Milestones—the document tracking security gaps and your plan to remediate them.
Understanding how conditional certification works helps you decide whether to pursue it and succeed if you do.
How Conditional Certification Works
Conditional certification is not a lesser certification—it is a pathway to full certification with a commitment to close remaining gaps.
The Basic Framework
- You must meet at least 80% of Level 2 requirements
- Remaining gaps must be documented in a POA&M
- You have exactly 180 days to close all POA&M items
- Once POA&M is complete, it converts to full certification
- If POA&M is not completed, conditional certification is revoked
Scoring Threshold
The 80% threshold translates to SPRS scoring:
SPRS stands for Supplier Performance Risk System—where compliance scores are reported.
- Perfect score: 110 points
- 80% threshold: Score of 80 or higher
- Recommended minimum: Score of 88+ (allows buffer)
What Conditional Certification Provides
With conditional certification, you can:
- Bid on and perform contracts requiring CMMC Level 2
- Demonstrate compliance and commitment to the primes
- Continue business while completing remediation
What Conditional Certification Does Not Provide
Conditional certification is not indefinite:
- 180-day deadline is firm—no extensions
- Failure to complete POA&M revokes certification
- Some contracts may not accept a conditional status
- Primes may have additional requirements
Determining If Conditional Certification Is Right for You
Good Candidates for Conditional
Conditional certification makes sense when:
- You have a small number of well-defined gaps
- Gaps have clear remediation paths
- Resources are available to complete remediation quickly
- Contract opportunity requires near-term certification
- 180 days is realistically sufficient
Poor Candidates for Conditional
Conditional certification is risky when:
- Many controls are NOT MET
- Gaps require major infrastructure changes
- Resources for rapid remediation are uncertain
- Complex dependencies between gap items
- Score is barely above 80
The Math Matters
Calculate your realistic position:
- How many controls are NOT MET?
- What is the total point deduction?
- Can all items realistically close in 180 days?
- What happens if some items take longer?
If your score is 82 and you have eight open items, the math is tight. If several items slip, you could fail.
POA&M Requirements for Conditional Certification
Not any POA&M qualifies. Specific requirements apply:
Required POA&M Elements
Each item must include:
- Specific control that is NOT MET
- Description of the gap
- Planned remediation actions
- Resources required
- Responsible party
- Interim milestones
- Target completion date (within 180 days)
POA&M Quality Standards
Assessors evaluate POA&M quality:
Realistic Plans
Remediation plans must be achievable. “We will implement SIEM in 30 days,” when you have no logging infrastructur,e is not credible.
SIEM stands for Security Information and Event Management—centralized logging and analysis.
Specific Actions
“Improve access control” is too vague. “Implement role-based access control using Active Directory groups, migrate users by department, complete by [date]” is specific.
Resource Commitment
Plans should show you have the resources to execute:
- Budget allocated
- Personnel assigned
- Vendors engaged (if applicable)
- Technology procured or ordered
POA&M Limitations
Some controls cannot remain on POA&M for conditional certification:
- Certain fundamental security controls must be implemented
- C3PAOs evaluate whether your gaps are acceptable for conditional status
- Too many critical gaps may disqualify conditional certification
Check current DoD guidance for specific controls that cannot be on POA&M.
C3PAO stands for Certified Third-Party Assessment Organization—the company that conducts your assessment.
The 180-Day Clock
Understanding the timeline is critical:
When the Clock Starts
The 180-day period begins when conditional certification is granted, not when:
- Assessment ends
- You receive the report
- You decide to start remediation
Plan remediation before assessment so you can execute immediately.
180 Days Is Not Six Months
180 calendar days is approximately six months, but:
- Weekends count
- Holidays count
- Vendor delays count
- Staff vacations count
- Everything counts
Build buffer into your remediation timeline.
What Happens at Day 180
At the 180-day mark:
If POA&M is complete:
- Notify your C3PAO
- C3PAO verifies closure
- Conditional converts to full certification
- Certification is valid for three years
If POA&M is not complete:
- Conditional certification is revoked
- You are no longer CMMC Level 2 certified
- Contract eligibility is affected
- Must complete a full reassessment to certify
There are no extensions. The deadline is firm.
Executing POA&M Remediation
Successful remediation requires disciplined execution:
Immediate Actions (Days 1-30)
Start fast:
- Finalize detailed remediation plan
- Assign ownership for each item
- Secure the required budget and resources
- Order technology and engage vendors
- Begin quick-win remediations
Steady Progress (Days 30-120)
Maintain momentum:
- Weekly status reviews
- Track progress against milestones
- Identify and address blockers immediately
- Document completion of items
- Adjust plans if needed (while staying within the deadline)
Verification and Closure (Days 120-180)
Complete and verify:
- Finish all remediation activities
- Collect evidence of implementation
- Verify controls work as intended
- Document closure of each POA&M item
- Prepare for C3PAO verification
Buffer Time
Reserve the final 30 days for:
- Unexpected delays
- Verification activities
- C3PAO coordination
- Documentation finalization
Closing POA&M Items
Closing items require evidence, not just claims:
Evidence of Remediation
For each closed item, document:
- What was implemented
- Configuration evidence (screenshots, exports)
- Process evidence (procedures, records)
- Testing evidence (verification that control works)
- Date of completion
C3PAO Verification
When you believe all items are closed:
- Notify your C3PAO
- Provide closure evidence for all items
- C3PAO reviews evidence
- C3PAO may request additional information
- C3PAO verifies closure
- Certification status updated
Partial Closure Is Not Closure
You cannot convert to full certification with items remaining. All POA&M items must be verified closed before the deadline.
Managing Remediation Risks
Remediation projects have risks. Manage them actively:
Resource Risks
- Key personnel leave or are unavailable
- The budget is cut or delayed
- Competing priorities consume resources
Mitigation: Secure executive commitment, document resource allocation, and identify backup personnel.
Technical Risks
- Technology does not work as expected
- Integration problems delay implementation
- Complexity is greater than anticipated
Mitigation: Start technical work early, test in non-production first, have contingency approaches.
Vendor Risks
- Vendor delivery delays
- Implementation takes longer than quoted
- Vendor quality is inadequate
Mitigation: Engage vendors early, get firm commitments, and have backup vendors identified.
Scope Risks
- Additional gaps discovered during remediation
- Control implementation reveals related issues
- Scope expands beyond original items
Mitigation: Conduct thorough gap assessment before assessment, address related items proactively.
What If You Cannot complete POA&M?
If completion looks impossible:
Before Deadline
Explore options:
- Can you accelerate any items?
- Can you add resources?
- Are there alternative implementations?
- Have you escalated to executives?
At Deadline
If truly unable to complete:
- Document your situation
- Understand contract implications
- Plan for reassessment
- Communicate with contracting officers and primes
Losing conditional certification is serious but not necessarily fatal to your business: transparency and rapid remediation matter.
Conditional vs. Waiting for Full Certification
Consider whether conditional certification is the right approach:
Pursue Conditional When:
- Contract opportunity has a near-term deadline
- Gaps are small, and remediation is certain
- You have the resources to execute rapidly
- Score is comfortably above 80
Wait for Full Certification When:
- No immediate contract pressure
- Significant gaps remain
- The remediation timeline is uncertain
- Score is close to the 80 threshold
Conditional certification adds pressure and risk. If you can wait, achieving full certification without the 180-day clock may be less stressful.
Key Takeaways
Conditional CMMC Level 2 certification allows you to certify while completing the remaining remediation, provided you meet at least 80% of requirements (score of 80+). You have exactly 180 days to close all POA&M items—this deadline is firm with no extensions.
POA&M items must have specific, realistic remediation plans with milestones and completion dates. Assessors evaluate whether your plans are achievable.
Execute remediation immediately after receiving conditional certification. Track progress rigorously, manage risks actively, and reserve buffer time for unexpected issues.
Conditional certification is a tool, not a shortcut. Use it strategically when gaps are small and remediation is certain.
Free tools
Get to an honest number faster
You will run this more than once: after any material change to your environment, and again before every annual affirmation. Both are free, and both are yours to keep.
Neither is a certified assessment, and neither pretends to be.
Official sources
The audit is gone. The liability isn't.
Greypike runs the environment your CUI lives in and owns the compliance outcome that proves it's protected. If you are not certain your environment supports the score sitting in SPRS next to your CAGE code, that is the conversation to have.
Talk to Greypike about SPRS Attestation Assurance