An OSC receives a POA&M during their CMMC L2 assessment. 170 days later, they submit an updated POA&M with evidence of all corrective actions. Can…

Under the CMMC 2.0 program, an Organization Seeking Certification (OSC) that receives a "CMMC Level 2 Conditional Certification" is permitted to have a Plan of Action & Milestones (POA&M) for certain non-critical, unmet practices. The OSC is granted a 180-day period, starting from the assessment's completion date, to remediate these items. Since the OSC submitted evidence of corrective actions at 170 days, they are within the allowed timeframe. The C3PAO is therefore able to proceed with a POA&M close-out assessment to verify that the remediation actions are complete and effective.

A. No, the 180-day window has closed.

This is factually incorrect. The submission at 170 days is within the 180-day period allowed for POA&M remediation.

B. No, the OSC must wait for the next assessment cycle.

This is incorrect. The POA&M close-out process is specifically designed to allow certification within the current cycle without requiring a full new assessment.

D. Yes, but the OSC must re-perform the entire CMMC L2 assessment.

This is incorrect. A close-out assessment is a limited-scope engagement focused solely on verifying the remediation of the specific items listed on the POA&M.

---

1. Title 32, Code of Federal Regulations, Part 170, "Cybersecurity Maturity Model Certification (CMMC) Program" (December 26, 2023).

§ 170.22(a): "An OSC that has been issued a CMMC Level 2 Conditional Certification Assessment must resolve all POA&M items within 180 calendar days of the assessment completion date identified in the final report." This confirms the 180-day window.

§ 170.22(c): "The C3PAO will conduct a POA&M closeout assessment to verify that all POA&M items have been resolved." This confirms the C3PAO's role in conducting the close-out.

2. The Cyber AB, CMMC Assessment Process (CAP) for CMMC Level 2, Version 2.1 (or latest version).

The CAP document outlines the procedural steps for a CMMC assessment. The section on POA&M Closeout details that the OSC has 180 days to submit evidence of remediation, after which the C3PAO conducts a closeout assessment to verify the evidence and convert a conditional certification to a final one. This process validates that a close-out assessment is the correct next step.