Achieving Conditional CMMC Level 2 Certification with POA&M

Perfect compliance on assessment day is ideal, but not always achievable. CMMC recognizes this reality by allowing conditional Level 2 certification when you meet most—but not all—requirements. Conditional certification provides a path forward while you completethe remaining remediation, but it comes with strict rules and a firm deadline.

CMMC stands for Cybersecurity Maturity Model Certification—the DoD’s mandatory cybersecurity program for defense contractors.

POA&M stands for Plan of Action and Milestones—the document tracking security gaps and your plan to remediate them.

Understanding how conditional certification works helps you decide whether to pursue it and succeed if you do.

How Conditional Certification Works

Conditional certification is not a lesser certification—it is a pathway to full certification with a commitment to close remaining gaps.

The Basic Framework

• You must meet at least 80% of Level 2 requirements
• Remaining gaps must be documented in a POA&M
• You have exactly 180 days to close all POA&M items
• Once POA&M is complete, it converts to full certification
• If POA&M is not completed, conditional certification is revoked

Scoring Threshold

The 80% threshold translates to SPRS scoring:

SPRS stands for Supplier Performance Risk System—where compliance scores are reported.

• Perfect score: 110 points
• 80% threshold: Score of 80 or higher
• Recommended minimum: Score of 88+ (allows buffer)

What Conditional Certification Provides

With conditional certification, you can:

• Bid on and perform contracts requiring CMMC Level 2
• Demonstrate compliance and commitment to the primes
• Continue business while completing remediation

What Conditional Certification Does Not Provide

Conditional certification is not indefinite:

• 180-day deadline is firm—no extensions
• Failure to complete POA&M revokes certification
• Some contracts may not accept a conditional status
• Primes may have additional requirements

Determining If Conditional Certification Is Right for You

Good Candidates for Conditional

Conditional certification makes sense when:

• You have a small number of well-defined gaps
• Gaps have clear remediation paths
• Resources are available to complete remediation quickly
• Contract opportunity requires near-term certification
• 180 days is realistically sufficient

Poor Candidates for Conditional

Conditional certification is risky when:

• Many controls are NOT MET
• Gaps require major infrastructure changes
• Resources for rapid remediation are uncertain
• Complex dependencies between gap items
• Score is barely above 80

The Math Matters

Calculate your realistic position:

• How many controls are NOT MET?
• What is the total point deduction?
• Can all items realistically close in 180 days?
• What happens if some items take longer?

If your score is 82 and you have eight open items, the math is tight. If several items slip, you could fail.

POA&M Requirements for Conditional Certification

Not any POA&M qualifies. Specific requirements apply:

Required POA&M Elements

Each item must include:

• Specific control that is NOT MET
• Description of the gap
• Planned remediation actions
• Resources required
• Responsible party
• Interim milestones
• Target completion date (within 180 days)

POA&M Quality Standards

Assessors evaluate POA&M quality:

Realistic Plans

Remediation plans must be achievable. “We will implement SIEM in 30 days,” when you have no logging infrastructur,e is not credible.

SIEM stands for Security Information and Event Management—centralized logging and analysis.

Specific Actions

“Improve access control” is too vague. “Implement role-based access control using Active Directory groups, migrate users by department, complete by [date]” is specific.

Resource Commitment

Plans should show you have the resources to execute:

• Budget allocated
• Personnel assigned
• Vendors engaged (if applicable)
• Technology procured or ordered

POA&M Limitations

Some controls cannot remain on POA&M for conditional certification:

• Certain fundamental security controls must be implemented
• C3PAOs evaluate whether your gaps are acceptable for conditional status
• Too many critical gaps may disqualify conditional certification

Check current DoD guidance for specific controls that cannot be on POA&M.

C3PAO stands for Certified Third-Party Assessment Organization—the company that conducts your assessment.

The 180-Day Clock

Understanding the timeline is critical:

When the Clock Starts

The 180-day period begins when conditional certification is granted, not when:

• Assessment ends
• You receive the report
• You decide to start remediation

Plan remediation before assessment so you can execute immediately.

180 Days Is Not Six Months

180 calendar days is approximately six months, but:

• Weekends count
• Holidays count
• Vendor delays count
• Staff vacations count
• Everything counts

Build buffer into your remediation timeline.

What Happens at Day 180

At the 180-day mark:

If POA&M is complete:

• Notify your C3PAO
• C3PAO verifies closure
• Conditional converts to full certification
• Certification is valid for three years

If POA&M is not complete:

• Conditional certification is revoked
• You are no longer CMMC Level 2 certified
• Contract eligibility is affected
• Must complete a full reassessment to certify

There are no extensions. The deadline is firm.

Executing POA&M Remediation

Successful remediation requires disciplined execution:

Immediate Actions (Days 1-30)

Start fast:

• Finalize detailed remediation plan
• Assign ownership for each item
• Secure the required budget and resources
• Order technology and engage vendors
• Begin quick-win remediations

Steady Progress (Days 30-120)

Maintain momentum:

• Weekly status reviews
• Track progress against milestones
• Identify and address blockers immediately
• Document completion of items
• Adjust plans if needed (while staying within the deadline)

Verification and Closure (Days 120-180)

Complete and verify:

• Finish all remediation activities
• Collect evidence of implementation
• Verify controls work as intended
• Document closure of each POA&M item
• Prepare for C3PAO verification

Buffer Time

Reserve the final 30 days for:

• Unexpected delays
• Verification activities
• C3PAO coordination
• Documentation finalization

Closing POA&M Items

Closing items require evidence, not just claims:

Evidence of Remediation

For each closed item, document:

• What was implemented
• Configuration evidence (screenshots, exports)
• Process evidence (procedures, records)
• Testing evidence (verification that control works)
• Date of completion

C3PAO Verification

When you believe all items are closed:

1. Notify your C3PAO
2. Provide closure evidence for all items
3. C3PAO reviews evidence
4. C3PAO may request additional information
5. C3PAO verifies closure
6. Certification status updated

Partial Closure Is Not Closure

You cannot convert to full certification with items remaining. All POA&M items must be verified closed before the deadline.

Managing Remediation Risks

Remediation projects have risks. Manage them actively:

Resource Risks

• Key personnel leave or are unavailable
• The budget is cut or delayed
• Competing priorities consume resources

Mitigation: Secure executive commitment, document resource allocation, and identify backup personnel.

Technical Risks

• Technology does not work as expected
• Integration problems delay implementation
• Complexity is greater than anticipated

Mitigation: Start technical work early, test in non-production first, have contingency approaches.

Vendor Risks

• Vendor delivery delays
• Implementation takes longer than quoted
• Vendor quality is inadequate

Mitigation: Engage vendors early, get firm commitments, and have backup vendors identified.

Scope Risks

• Additional gaps discovered during remediation
• Control implementation reveals related issues
• Scope expands beyond original items

Mitigation: Conduct thorough gap assessment before assessment, address related items proactively.

What If You Cannot complete POA&M?

If completion looks impossible:

Before Deadline

Explore options:

• Can you accelerate any items?
• Can you add resources?
• Are there alternative implementations?
• Have you escalated to executives?

At Deadline

If truly unable to complete:

• Document your situation
• Understand contract implications
• Plan for reassessment
• Communicate with contracting officers and primes

Losing conditional certification is serious but not necessarily fatal to your business: transparency and rapid remediation matter.

Conditional vs. Waiting for Full Certification

Consider whether conditional certification is the right approach:

Pursue Conditional When:

• Contract opportunity has a near-term deadline
• Gaps are small, and remediation is certain
• You have the resources to execute rapidly
• Score is comfortably above 80

Wait for Full Certification When:

• No immediate contract pressure
• Significant gaps remain
• The remediation timeline is uncertain
• Score is close to the 80 threshold

Conditional certification adds pressure and risk. If you can wait, achieving full certification without the 180-day clock may be less stressful.

Key Takeaways

Conditional CMMC Level 2 certification allows you to certify while completing the remaining remediation, provided you meet at least 80% of requirements (score of 80+). You have exactly 180 days to close all POA&M items—this deadline is firm with no extensions.

POA&M items must have specific, realistic remediation plans with milestones and completion dates. Assessors evaluate whether your plans are achievable.

Execute remediation immediately after receiving conditional certification. Track progress rigorously, manage risks actively, and reserve buffer time for unexpected issues.

Conditional certification is a tool, not a shortcut. Use it strategically when gaps are small and remediation is certain.

Related Articles:

• Understanding the 110 NIST 800-171 Controls
• CMMC Level 2 C3PAO Assessment: What to Expect
• Creating a Plan of Action and Milestones
• How to Calculate Your SPRS Score
• 32 CFR Part 170 – CMMC Program Rule
• NIST SP 800-171 Rev 2
• DoD CMMC Level 2 Assessment Guide

Official Sources: This article is based on 32 CFR Part 170 conditional certification requirements, NIST SP 800-171 Revision 2, and DoD CMMC assessment guidance.

Navigating conditional certification requires expert guidance. Contact Greypike for help developing a POA&M that passes assessment and a remediation plan that meets the 180-day deadline. Not ready for Level 2? Start with Obolix—our Level 1 platform gets you compliant in a week or less and builds the foundation for your Level 2 journey.