Can I have open POA&M items at my CMMC assessment and still pass?

The POA&M mechanism is a defined, time-bounded path between an initial assessment with gaps and a Final CMMC Status. Per the CMMC 101 (Nov 2025) brief and 32 CFR § 170.21, it is not a pre-assessment planning tool. The POA&M exists for gaps that surface during the assessment itself or arise from operations after the initial assessment. It does not exist for items the OSA already knew were unfinished going into the assessment.

What the POA&M is for, and what it is not for

The POA&M serves a specific purpose: it acknowledges that some practices may be NOT MET at the time of the initial assessment, and provides a 180-day window for the OSA to remediate while still receiving a Conditional CMMC Status. It is not:

• A planning mechanism for known gaps the OSA has not yet addressed before assessment.
• A way to schedule expensive remediation across a longer timeline than the 180-day rule allows.
• A negotiation tool with the C3PAO for items the OSA could have completed before the on-site week.

Operational POA&M items versus pre-existing known gaps

The assessor distinguishes two categories of POA&M items, and the distinction matters.

Operational POA&M items (appropriate):

• Gaps that surfaced during the assessment itself because the assessor identified an issue the OSA had not seen.
• Findings from the C3PAO's testing that the OSA had reasonable basis to believe were addressed.
• Gaps from continuous monitoring after the initial assessment that arise during ongoing operations.
• Issues that emerged from environmental changes (vendor end-of-life, a new vulnerability disclosure, a change in the threat landscape).

Pre-existing known gaps (not appropriate):

• Practices the OSA knows are not implemented coming into the assessment.
• Configuration changes the OSA has not gotten around to making.
• Documentation the OSA started but did not finish.
• Training that was scheduled but not delivered.
• Tools that were budgeted but not procured.

These should be remediated before the initial assessment, not POA&M'd. An OSA that walks into the assessment with a list of known gaps to POA&M is signaling that the organization prepared poorly, and the assessor will probe accordingly.

What to do if you know about a gap before the assessment

If you know going into the assessment that a particular practice is not implemented, you have three real options:

1. Implement it before the assessment. This is the preferred path. Use the pre-assessment timeline (90/60/30 days out) to close known gaps.
2. Postpone the assessment until you can implement it. Sometimes the only option. Better to delay than to fail.
3. Accept that the assessment may fail. The worst option, but more honest than walking in expecting to POA&M known work.

The POA&M was never the fourth option. The rule added it to handle gaps that surface during assessment, not to let contractors defer obvious work.

Why this matters to the assessor

When the assessor sees a long list of POA&M items at the end of the on-site week, two interpretations are possible:

1. The OSA was well prepared and the gaps are operational items that emerged during the assessment.
2. The OSA was poorly prepared and brought a list of known undone work hoping to POA&M it.

The assessor has discretion in how rigorously to scrutinize each POA&M item and the surrounding evidence. An assessor who concludes the OSA is gaming the POA&M mechanism will look harder at every other determination, ask more probing questions, and be less inclined to accept marginal evidence elsewhere in the assessment.

The three constraints

1. Minimum passing score. Under § 170.21, the initial assessment must achieve at least 80% (88 of 110) after the POA&M-item deductions are subtracted from the maximum score. POA&M items do not pause the score; they just defer remediation while still counting against the total.
2. Restricted practices. § 170.21(a)(2) sets a two-part exclusion for L2 (Self or C3PAO). First, no POA&M item may have a point value greater than 1 in the CMMC Scoring Methodology, with one carve-out: SC.L2-3.13.11 (CUI Encryption) may be on a POA&M at point value 3 if encryption is employed but not FIPS-validated. This is what excludes the 5-point practices in practice, including IA.L2-3.5.3 (MFA), which is prohibited via the point-value cap rather than being named explicitly. Second, six L2 requirements are named as never-allowed on a POA&M even though they are 1-point practices: AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4, PE.L2-3.10.5. § 170.21(a)(3) names seven L3 requirements that may not be on a POA&M for Level 3 certifications. The full list and the FIPS carve-out are detailed in Which CMMC controls can NOT be on a POA&M?.
3. 180-day closeout window. POA&M items must be closed and verified within 180 days of the initial assessment results being entered in SPRS (for L2 self-assessments) or eMASS (for L2 certifications and L3). Failure to close within 180 days causes the Conditional CMMC Status to expire.

Conditional vs Final CMMC Status

Who verifies the closeout

• L2 Self-Assessment POA&M closeout, conducted by the OSA itself.
• L2 Certification POA&M closeout, conducted by the C3PAO that performed the initial assessment.
• L3 POA&M closeout, conducted by DIBCAC.

Common errors

• POA&Ming a restricted practice and assuming it's allowed. The rule lists the restricted practices explicitly; verify against § 170.21 before submitting.
• Missing the 180-day deadline. Closeout often requires evidence collection, control implementation, and re-testing, six months is less time than it sounds. Build the closeout schedule before submitting the initial assessment.
• Letting the Conditional Status expire and assuming you can renew. An expired Conditional Status requires a new initial assessment, not a closeout. Time and cost reset.
• Using POA&Ms as an indefinite parking lot. A control on a POA&M for 180 days is a deliberate gap with a firm fix date, not a permanent state.