Final vs. Conditional CMMC status: POA&Ms and the 180-day closeout
When a CMMC assessment can end in Conditional status, which gaps can sit on a POA&M, what the 180-day closeout means for your contracts, and how validity and affirmations work.
- Reading time
- 5 min read
- Last reviewed
- Sources
- 4 official sources
On this page
A CMMC status has three parts: a level (1, 2 or 3), an assessment type (Self, C3PAO or DIBCAC) and a state. The state is either Final, meaning every requirement in scope is met, or Conditional, meaning the assessment cleared a minimum score and the few remaining gaps are recorded on a Plan of Action and Milestones (POA&M) that must be closed on a deadline. The rules are in 32 CFR 170.21. For a prime choosing partners, the difference between "Final Level 2 (C3PAO)" and "Conditional Level 2 (C3PAO)" is the difference between a settled fact and a date to watch.
When Conditional status is possible
| Level | Can it be Conditional? | Conditions (32 CFR 170.21) |
|---|---|---|
| Level 1 (Self) | No | POA&Ms are not permitted. All 15 FAR 52.204-21 requirements must be met. |
| Level 2 (Self or C3PAO) | Yes | The assessment score must be at least 80% of the maximum (88 of 110). Open items may only be requirements worth 1 point in the scoring methodology, with a narrow exception for encryption that is in place but not FIPS-validated. A short list of requirements can never be on a POA&M. |
| Level 3 (DIBCAC) | Yes | A similar 80% threshold applied to the 24 Level 3 requirements, with its own list of requirements that cannot be deferred. |
The "never on a POA&M" list for Level 2 includes the system security plan requirement (3.12.4) and several controls over external connections, public information and physical access. If any of those is not met, the result is not Conditional: it is a failed assessment for that scope. Check 32 CFR 170.21 for the full list before you decide what can wait.
The 180-day closeout
Conditional status is a countdown. The open POA&M items must be remediated and verified in a POA&M closeout assessment within 180 days of the Conditional status date:
- Level 2 (Self): you perform the closeout self-assessment and update SPRS.
- Level 2 (C3PAO): a C3PAO performs the closeout assessment.
- Level 3 (DIBCAC): DIBCAC performs the closeout assessment.
A successful closeout converts the status to Final. If the deadline passes, the Conditional status expires. Under the rule, standard contractual remedies then apply to contracts that required that status, and the company is not eligible for new awards that require it for the affected system until it earns a new status.
Example: A C3PAO assessment on March 2 ends in Conditional Level 2 (C3PAO) with three 1-point items on the POA&M. The closeout assessment must be completed by the 180th day after March 2. A proposal due in May and an award expected in October means the prime is betting on that closeout happening on time, so expect questions about it.
Status, validity and affirmations
| Status | What it means | How long it lasts |
|---|---|---|
| Final Level 1 (Self) | All 15 requirements met | One year: self-assess and affirm annually |
| Conditional Level 2 or Level 3 | Minimum score met with permitted POA&M items | Until closeout, at most 180 days |
| Final Level 2 (Self or C3PAO) | All requirements met, or the POA&M closed out | Up to 3 years, with annual affirmations |
| Final Level 3 (DIBCAC) | All Level 3 requirements met, or the POA&M closed out | Up to 3 years, with annual affirmations |
Affirmations (32 CFR 170.22) are filed in SPRS by the company's Affirming Official, a senior official responsible for compliance. They are required after every assessment, after a POA&M closeout and every year. Treat the affirmation date like an expiration date: it is part of keeping a status current, and it is one of the first things a prime or contracting officer checks.
What Conditional status means for teaming
For a prime, a Conditional partner is not disqualifying, but it is a dependency. Before you commit workshare, line the closeout deadline up against the proposal due date, the expected award date and any option dates. If the deadline falls before award, ask for evidence that remediation is on track and that the closeout assessment is scheduled.
For a subcontractor, Conditional status is a good-faith position to be transparent about. Telling a prime "Conditional, closeout scheduled for June 12" builds more confidence than "Level 2 compliant."
Closeout checklist for Conditional organizations
Checklist: tick items as you go (saved in this browser only)
Common pitfalls
- Assuming everything can go on the POA&M. Only low-weight items qualify, and some requirements never do. A gap in one of the excluded requirements fails the assessment for that scope.
- Missing the closeout by days. There is no grace period in the rule. Plan the closeout well inside the window.
- Forgetting the affirmation after closeout. The closeout is not finished until the affirmation is filed.
- Advertising Conditional as Final. Misstating your status to a prime or in a representation creates real legal exposure. State the status exactly as SPRS shows it.
Tip: POA&M items also count against your NIST SP 800-171 score until they are fixed (see SPRS scoring). Closing them improves both your CMMC status and the score you post under DFARS 252.204-7019.
How TeamingIndex helps
- Every CMMC badge distinguishes Final from Conditional and shows the closeout due date, the expiration date and whether an affirmation is overdue.
- Record your status, dates and affirmations on your compliance dashboard. If you change a CMMC fact after it was verified, the verification goes back to review so badges never overstate your status.
- The Team Builder shows when a partner's status is Conditional so you can weigh the closeout date against your pursuit timeline.
- New to CMMC? Start with the CMMC 2.0 overview.
Not legal advice. TeamingIndex guides are general information to help you plan, not legal advice. Regulations, clauses and program rules change and solicitations can tailor them: always work from the current regulation and the clauses in your solicitation, and confirm decisions with your contracting officer or counsel.
Official sources
Primary regulations and program pages this guide was checked against on . Read them for the authoritative text.
- 32 CFR 170.21: Plan of Action and Milestones requirementsecfr.gov(opens in a new tab)
- 32 CFR 170.22: Affirmationecfr.gov(opens in a new tab)
- 32 CFR Part 170: CMMC Program (levels, assessments, validity)ecfr.gov(opens in a new tab)
- DoD CIO: CMMC resources and documentationdodcio.defense.gov(opens in a new tab)