Full certification requires meeting all 110 requirements. Conditional Level 2 status is granted at a minimum of 88 of 110 requirements met (80%), with remaining gaps in a POA&M that must close within 180 days — and the highest-weight controls cannot be POA&M-ed at all.
Rules that surprise people
- Failing MFA, FIPS encryption or similar 5-point controls usually blocks even conditional status
- The 180-day clock is hard: miss it and the conditional certificate lapses
- Annual affirmations continue after certification — compliance is not one-and-done
Know your number before the assessor does: the ITSecOps SPRS calculator shows exactly which controls carry 5, 3 or 1 points and whether your gaps are POA&M-eligible.