During the on-site assessment, the assessment team thoroughly evaluated an OSC’s systems, policies, procedures, and practices against the 110 CMMC…

To achieve CMMC Level 2 Certification, an Organization Seeking Certification (OSC) must meet all 110 security practices. The CMMC program allows for a "Conditional Certification" if an OSC has a limited number of unmet practices documented in a Plan of Action and Milestones (POA&M). However, to be eligible for this conditional status, the OSC must meet a minimum of 80% of the total practices. For Level 2, this threshold is 88 practices (80% of 110).

In this scenario, the OSC has only met 85 practices, which is below the 88-practice minimum. Therefore, the OSC is not eligible for a Conditional Certification and must be given a final finding of "Not Achieved."

B. Deferring the recommendation is not a formal outcome of a CMMC assessment. The assessor must make a recommendation based on the evidence at the conclusion of the assessment period.

C. The OSC is ineligible for a ‘Conditional Certification’ because it has met only 85 practices, which is below the required 80% (88 practices) minimum threshold.

D. Full ‘CMMC Level 2 Certification’ is incorrect because it requires all 110 practices to be scored as ‘MET’, and the OSC has 25 deficiencies.

---

1. U.S. Department of Defense (DoD), Federal Register, 32 CFR Part 170, "Cybersecurity Maturity Model Certification (CMMC) Program," Proposed Rule.

Reference: Section § 170.20, "CMMC assessment and CMMC certification," paragraph (c)(2)(i). This section outlines the requirements for a CMMC Conditional Certification, stating, "The OSC has met, at the time of the CMMC assessment, all CMMC requirements for the CMMC Level sought that are not POA&M-able CMMC requirements and at least eighty percent of all CMMC requirements for the CMMC Level sought." This directly supports that 85/110 practices is insufficient.

2. U.S. Department of Defense (DoD), Office of the Under Secretary of Defense for Acquisition and Sustainment, "CMMC Model Overview v2.0," December 2021.

Reference: Page 10, "POA&Ms and Waivers." The document states, "For CMMC Level 2, the Department intends to allow for a time-bound Plan of Action and Milestones (POA&M)..." and subsequent guidance in the proposed rule established the specific thresholds. The fundamental principle is that not all practices can be on a POA&M, and a minimum score must be achieved.

3. The Cyber AB, "CMMC Assessment Process (CAP) for CMMC Level 2," Version 2.1, January 2024.

Reference: Section 5.7, "Final Findings." This section details the possible outcomes of an assessment. A "NOT MET" finding for any practice, without eligibility for a POA&M closeout, results in a failed assessment. The eligibility for POA&M closeout is governed by the rules specified in 32 CFR Part 170, including the 80% threshold.