When a CMMC plan of action and milestones is allowed.

What the document is

32 CFR 170.4 says a plan of action and milestones identifies tasks needing to be accomplished. It details resources required to accomplish the elements of the plan, any milestones in meeting the tasks, and scheduled completion dates for the milestones. The section attributes that definition to NIST SP 800-115, September 2008, incorporated by reference. ²

The same definitions section separates this document from an operational plan of action. An operational plan of action identifies temporary vulnerabilities and temporary deficiencies and documents how they will be mitigated, corrected, or eliminated. It does not identify a timeline for remediation. It is not the same as a plan of action and milestones, which is tied to an assessment and must be completed within 180 days. ²

Level 1

A plan of action and milestones is not permitted at any time for Level 1 self-assessments. ¹

Level 2, all three conditions

An organization seeking assessment is permitted to achieve Conditional Level 2 (Self) or Conditional Level 2 (C3PAO) only if all of the following are met. ¹

The assessment score divided by the total number of CMMC Level 2 security requirements is greater than or equal to 0.8.

None of the security requirements on the plan have a point value greater than 1 as specified in 32 CFR 170.24, except SC.L2-3.13.11, CUI Encryption. That requirement may be included on the plan if encryption is employed and it is not FIPS-validated, which results in a point value of 3.

None of these requirements are included on the plan:

• AC.L2-3.1.20 External Connections (CUI Data).
• AC.L2-3.1.22 Control Public Information (CUI Data).
• CA.L2-3.12.4 System Security Plan.
• PE.L2-3.10.3 Escort Visitors (CUI Data).
• PE.L2-3.10.4 Physical Access Logs (CUI Data).
• PE.L2-3.10.5 Manage Physical Access (CUI Data).

32 CFR 170.24 is where the point values come from. Requirements scored at 5 points, and requirements scored at 3 points, are above the "greater than 1" line, so they stay off the plan except for the encryption case the section writes out. A plan of action and milestones is not a substitute for a completed requirement. A requirement that is not implemented is assessed as NOT MET whether or not it is written up in the plan. ³

Level 3, if a contract asks for it

Conditional Level 3 (DIBCAC) is allowed only if the assessment score divided by the total number of CMMC Level 3 security requirements is greater than or equal to 0.8, and the plan does not include any of these requirements: IR.L3-3.6.1e Security Operations Center, IR.L3-3.6.2e Cyber Incident Response Team, RA.L3-3.11.1e Threat-Informed Risk Assessment, RA.L3-3.11.6e Supply Chain Risk Response, RA.L3-3.11.7e Supply Chain Risk Plan, RA.L3-3.11.4e Security Solution Rationale, and SI.L3-3.14.3e Specialized Asset Security. ¹

Closeout is 180 days

A closeout assessment assesses only the NOT MET requirements that were identified with the plan in the initial assessment. Closing the plan must be confirmed by that closeout assessment within 180 days of the Conditional CMMC Status Date. If it is not successfully closed out in that time, the conditional status for the information system expires. ¹

For a Level 2 self-assessment, the organization seeking assessment performs the closeout in the same manner as the initial self-assessment and posts the compliance results to the Supplier Performance Risk System within 180 days. For a Level 2 certification assessment, a C3PAO on the Accreditation Body's list performs the closeout. For Level 3, DCMA DIBCAC performs it. ^{1, 4}

32 CFR 170.4 says the conditional status date remains the CMMC status date after a successful closeout. A new date is not set for a final status that follows a conditional status. ²

The Department of War's July 13, 2026 implementing memorandum limits what program offices may designate during the suspension, and it does not rewrite 32 CFR 170.21. If you hold a conditional status, the 180-day closeout in the rule still runs from the conditional status date. ^{5, 1}

Compare tools for CMMC Level 2, with each published price and the date it was checked.

Sources checked October 16, 2026. Not legal advice.