The 180-day clock is set in 32 CFR § 170.21 and emphasized in the CMMC 101 (Nov 2025) brief. It is the single most-important time-management constraint in the assessment process.
The closeout mechanics
| Initial assessment type | Status during 180 days | Closeout assessor | System of record |
|---|---|---|---|
| Level 2 Self-Assessment | Conditional Level 2 (Self) | The OSA (self-conducted closeout) | SPRS |
| Level 2 Certification | Conditional Level 2 (C3PAO) | The C3PAO that performed the initial assessment | CMMC eMASS |
| Level 3 Certification | Conditional Level 3 (DIBCAC) | DCMA DIBCAC | CMMC eMASS |
What "closed" actually means
Per § 170.21, a POA&M item is closed when:
- The control is implemented and operating, with evidence to support it.
- The closeout assessment confirms the implementation through Examine, Interview, and/or Test methods (the same methods used at the initial assessment).
- The closeout result is entered in the system of record (SPRS or eMASS).
- The CMMC Status is updated from Conditional to Final.
What happens if the 180-day window expires
The Conditional CMMC Status expires. Practically:
- You are not authorized to bid on contracts requiring the CMMC Status that just expired.
- A new initial assessment is required — the closeout assessment is no longer available.
- For Level 2 Certification, that means engaging a C3PAO and going through the entire 110-practice certification again.
How to actually plan the 180 days
- Start the closeout plan before the initial assessment ends. For each anticipated POA&M item, identify the responsible owner, the implementation steps, the evidence to be produced, and the target date.
- Allocate weeks 1-4 to implementation — product configuration, policy adoption, training delivery.
- Allocate weeks 5-12 to evidence production — let the control operate long enough to produce assessor-quality evidence (typically 60-90 days).
- Allocate weeks 13-20 for closeout assessment scheduling and execution — closeout assessments often require coordination with the C3PAO and DIBCAC.
- Leave 30 days of buffer at the end for evidence gaps, re-testing, and SPRS/eMASS entry.
Common errors
- Treating the 180 days as a remediation window with no buffer. The 180 days includes implementation, operation, evidence production, AND closeout assessment. Six months is not a long time.
- Assuming the C3PAO will fit you in on demand. Closeout assessments require scheduling. Get on the C3PAO's calendar at the time of the initial assessment, not 150 days into the window.
- Letting the calendar lapse without entering the closeout result. The SPRS/eMASS entry is the official record. The control being implemented is not enough — the result must be recorded.
Sources
Plan the 180-day closeout with the right toolkit.
The CMMC Compliance Engine includes the POAM-TRK-01_Plan_of_Action_and_Milestones tracker and the PRO-CA-02_POAM_Management_Procedure for managing the closeout window end-to-end.
Get the CMMC Compliance Engine