CMMC Compliance Education
Your C3PAO assessor just flagged seven controls as 'NOT MET' — and now your program office wants to know whether you can still bid on the follow-on contract. Whether you can depends entirely on how your CMMC POA&M is structured, what it contains, and whether the clock has already started running.
What a CMMC POA&M Actually Is (and Isn't)
A CMMC POA&M — Plan of Action and Milestones, required by NIST SP 800-171 — grants a contractor Conditional CMMC Status when specific controls are unmet at assessment time. It is not a waiver. It is a time-bounded commitment to close identified gaps, subject to a formal closeout assessment.
The CMMC POA&M is one artifact within a full compliance program. TechSage's CMMC compliance services in San Antonio cover the POA&M alongside the System Security Plan, evidence packages, and ongoing assessment readiness — the POA&M alone does not constitute a compliance program.
Conditional CMMC Status allows continued performance on existing contracts while remediating. It does not guarantee award on new work, and it expires if the closeout assessment is not completed within the required window.
The CMMC POA&M Rules San Antonio Contractors Must Understand Before Opening One
Three mechanics determine whether a POA&M is available, which controls can be placed on it, and how long the contractor has to close it. Misunderstanding any one can result in loss of Conditional CMMC Status or an immediate full reassessment obligation.
The 80% / 88-Point SPRS Threshold
SPRS score is the numerical representation of NIST SP 800-171 compliance, calculated from a maximum of 110 points. A POA&M is only permitted when the contractor's SPRS score is 88 or above — no more than 22 points of deficiency at assessment. Contractors below 88 cannot defer any controls. Scoring 88 requires that the vast majority of controls already be implemented and evidenced; the POA&M covers the remainder, not the bulk of the work.
The Hard Prohibition on High-Value and CUI-Protection Controls
Certain controls cannot appear on a CMMC POA&M regardless of point value or SPRS score — specifically, any control worth more than one point and controls tied to CUI protection that CMMC 2.0 treats as non-deferrable:
- System Security Plan (SSP) maintenance: Must be implemented and current before assessment — cannot be deferred.
- Physical access restriction to CUI systems: Physical controls protecting CUI processing environments are excluded from POA&M deferral.
- Public information management: Controls governing publicly accessible information cannot be placed on a POA&M.
Contractors at JBSA-adjacent facilities frequently attempt to defer physical controls. Those controls are categorically excluded — no point-value calculation changes that.
The 180-Day Closeout Clock
The 180-day window starts the moment Conditional CMMC Status is granted — not when remediation begins. Missing the deadline triggers a full reassessment, not an extension. For firms managing active performance at Lackland AFB or across the JBSA supply chain, that carries real schedule and contract-vehicle risk.
What a Properly Built CMMC POA&M Must Contain
A CMMC POA&M that survives C3PAO closeout review must include six specific fields for each unmet control. Vague entries — particularly status fields reading "in progress" with no milestone dates — are a primary cause of closeout rejection.
- NIST control ID and requirement text: Identify the control by number (e.g., 3.1.1, 3.13.5) and state the full requirement — not a paraphrase.
- Gap description: Explain how the weakness was identified — self-assessment, C3PAO audit finding, or penetration test. Source of discovery matters to closeout assessors.
- Assigned owner with role specificity: Name a person and their role. "IT team" is not acceptable. Assessors require accountable individuals.
- Remediation milestone steps with target dates: Each milestone needs a discrete completion date. A single target date for the entire remediation is insufficient.
- Estimated budget: Document resource allocation per remediation item. Unfunded items signal a non-credible commitment.
- Current status: Must reflect actual state at each update — not the state at initial submission. A six-month-old "in progress" entry is a red flag.
The POA&M is a live document. Closeout assessors will expect a revision history demonstrating continuous management between assessment cycles.
The POA&M Mistakes That Cost San Antonio Contractors Their Conditional Status
Four failure modes account for the majority of conditional status losses among Level 2 contractors. Each is avoidable with operational discipline rather than additional technology.
Treating the POA&M as a One-Time Document
Contractors who file the POA&M at Conditional CMMC Status and do not update it through each milestone create an evidentiary gap that closeout assessors flag immediately. The POA&M must reflect current status at every stage of the remediation cycle.
Attempting to Defer Excluded Controls
Meeting the 88-point threshold is necessary but not sufficient. Contractors who then attempt to place multi-point or CUI-protection controls on the POA&M will have those entries rejected at closeout. The exclusion list applies regardless of SPRS score.
SSP-to-POA&M Inconsistency
The SSP is cross-referenced against the POA&M during both initial and closeout assessments. If a control is described as partially implemented in the SSP but listed as fully remediated in the POA&M closeout, that inconsistency is an immediate assessor flag. Keeping both documents synchronized throughout remediation is a closeout requirement.
Failing to Calendar the Closeout Assessment at Day 1
C3PAO scheduling is not immediate — assessment slots require advance coordination, and availability is constrained. Contractors who begin pursuing closeout scheduling at Day 150 routinely miss the deadline. The closeout assessment date must be calendared on the first day Conditional CMMC Status is granted.
TechSage Solutions — a San Antonio-based managed IT and compliance team serving local defense contractors — owns the remediation work alongside you, maintaining the POA&M as a live managed document so the 180-day clock does not catch you off guard. IT support for San Antonio defense contractors is a core TechSage practice area precisely because CMMC's operational discipline extends well beyond assessment day.
Frequently Asked Questions
Can a CMMC Level 1 contractor use a POA&M to defer controls?
No. POA&M use under CMMC 2.0 is available only for Level 2 and Level 3 contractors. CMMC Level 1 contractors — those handling only Federal Contract Information (FCI) under FAR 52.204-21 — must demonstrate full implementation of all 17 practices at assessment. No conditional status path exists at Level 1.
Which CMMC controls cannot be placed on a POA&M?
Controls worth more than one SPRS point cannot be deferred via POA&M. Specific CUI-protection controls are also categorically excluded regardless of point value — including SSP maintenance, physical access restriction to CUI systems, and public information management controls. These must be fully implemented before a C3PAO assessment.
How long do I have to close out a CMMC POA&M after conditional certification?
A contractor has 180 days from the date Conditional CMMC Status is granted to complete all POA&M remediation and pass a closeout assessment. The clock starts at status grant — not when remediation begins. C3PAO closeout assessments must be scheduled well in advance of the 180-day deadline.
How does a POA&M relate to the System Security Plan (SSP)?
The SSP documents how each NIST SP 800-171 control is implemented across the contractor's environment. The POA&M documents which controls are not yet fully implemented and how they will be remediated. C3PAO assessors cross-reference both documents — inconsistencies between the SSP and POA&M are a common closeout failure point under CMMC compliance requirements.
Does having open POA&M items disqualify me from bidding on DoD contracts?
Conditional CMMC Status with an active, compliant POA&M may allow continued performance on existing contracts, but eligibility for new contract awards depends on the specific contract's CMMC requirements and the contracting officer's determination. Open POA&M items do not automatically disqualify a bid, but they must be disclosed accurately in the SPRS system.
Who conducts the closeout assessment for a CMMC Level 2 POA&M?
For CMMC Level 2 contractors, the closeout assessment is conducted by a C3PAO — Certified Third-Party Assessment Organization — accredited by the Cyber AB. DCMA DIBCAC may conduct assessments for certain high-priority programs. The contractor cannot self-attest for POA&M closeout; a formal third-party assessment is required.
What is the minimum SPRS score needed to qualify for a CMMC POA&M?
A contractor must achieve an SPRS score of at least 88 out of 110 — representing approximately 80% of the maximum score under NIST SP 800-171 — before a POA&M is permitted under CMMC 2.0 Level 2. Contractors scoring below 88 at assessment are not eligible for Conditional CMMC Status and must remediate before certification can proceed.
Don't Let the 180-Day Clock Expire on Your CMMC Conditional Status
Schedule a free consultation with TechSage Solutions and we'll review your current POA&M posture, identify any controls you can't defer, and build a remediation roadmap calibrated to your contract timeline.
Schedule Your Free Consultation
