Sign in Subscribe

Which CMMC Requirements Can Go on a POA&M?

Share
Nothing you enter leaves this page. There is no server, no account, no storage. Your answers live in memory until you close the tab. You do not have to take that on trust: open your browser developer tools, switch to the Network tab, fill in the whole form, and watch it stay empty. There is no code on this page that can send anything: no analytics on your answers, no third-party scripts, no form that posts anywhere.

What you can defer

What you cannot defer

These are the ones that catch people out. A gap here does not wait for a POA&M, whatever your score is.

Your requirement status

Everything starts as Met. Change the ones that are not.

How the numbers work. The maximum score is 110. Each unmet requirement subtracts 5, 3, or 1 point. The weights are codified at 32 CFR 170.24: 44 requirements can cost 5 points, 14 cost 3, 51 cost 1, and CA.L2-3.12.4 is not scored. The maximum total deduction is therefore 44x5 + 14x3 + 51x1 = 313, and the lowest possible score is 110 - 313 = -203.

On that -203 figure. It is arithmetic, not a published number. No DoD document states a floor. 32 CFR 170.24 says only that scoring "may result in a negative score," and the DoD Assessment Methodology v1.2.1 says the same. Vendors repeat -203 without a citation because there is no DoD source to cite. The derivation above is the honest basis for it.

POA&M rules, from 32 CFR 170.21. A Conditional CMMC Status requires an assessment score divided by 110 of at least 0.8, which means a score of 88. Only requirements valued at 1 point or less may be on a POA&M, with a single stated exception: SC.L2-3.13.11 may be deferred when encryption is employed but is not FIPS-validated. Six requirements are barred outright regardless of point value: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5. Closeout is 180 days from the Conditional CMMC Status Date, after which the status expires.

Two things vendors commonly get wrong. IA.L2-3.5.3, multifactor authentication, is not POA&M eligible even in its partial state, because the exception at 170.21 names only 3.13.11. And the common shorthand that "5-point requirements cannot be deferred" is under-inclusive: the actual bar is anything above 1 point, which sweeps in every 3-point requirement too.

Planning use only. Any score produced here is a planning estimate. It is not an official SPRS score, a CMMC status, a certification result, or an assessor finding. It is not legal advice. Do not enter CUI, FCI, credentials, system configurations, or raw evidence anywhere on this page, and note that there is nowhere on this page to enter them by design.

This tells you what can wait. It does not track it.

A POA&M is a live document with a deadline: the closeout assessment has to happen within 180 days of the Conditional CMMC Status Date, and every deferred requirement needs an owner, a milestone, a target date and a closure record. The POA&M operational plan workbook in the suite is where that lives, next to the pre-assessment self-assessment workbook that produces the gap list in the first place.

See what is in the suite

Mac-first, one-time purchase, no subscription.

Where this fits