There are 15 practices that are NOT MET for an OSC's Level 2 Assessment. All practices are applicable to the OSC. Which determination should be…

The CMMC Assessment Process (CAP) specifies that an OSC can receive a conditional Level-2 certification with POA&Ms only when the total number of NOT MET practices “does not exceed 10 percent of the practices within scope.”

For Level 2, 110 practices are always in scope; 10 percent equals 11.

Because the OSC failed 15 practices—exceeding this 11-practice ceiling—it is automatically ineligible for the remediation/POA&M option. The correct determination therefore is that no option to remediate is available.

A. 90-day remediation is available only when the OSC is within the POA&M eligibility limit (≤11 NOT MET); 15 exceeds this.

C. Eligibility is not discretionary here; exceeding the 10 % cap makes the OSC definitively ineligible.

D. Assessment cancellation is not mentioned; ineligibility results from too many NOT MET practices, not from cancellation.

1. Cyber AB

“CMMC Assessment Process (CAP) v1.0

” §4.9.1 Eligibility for POA&M

p. 34 (28 Aug 2023) – states POA&Ms allowed only when NOT MET ≤ 10 % of practices.

2. Cyber AB

“CMMC Assessment Process (CAP) v1.0

” Table 4-3

p. 36 – Level 2 universe = 110 practices (hence 10 % = 11).

3. U.S. DoD

“CMMC Program Proposed Rule

” Fed. Reg. 88 FR 88596

§170.22(b)(3)(i) (2023) – mirrors CAP limit: up to 10 % of requirements may be on POA&M for conditional certification.