CMMC questions from the field · Conditional status, POA&M and the 180-day window · Updated September 2026
If your POA&M closeout is not finalized within 180 days of your Conditional CMMC Status Date, the Conditional Level 2 status expires automatically. Nothing else is triggered by the expiry itself: no fine, no debarment, no entry in a penalty register. But two consequences are written into the rule. Inside a running contract, “standard contractual remedies will apply.” And for new awards, you are “ineligible for additional awards with a requirement for the CMMC Status of Level 2 (Self), or higher requirement, for the information system within the CMMC Assessment Scope until such time as a new CMMC Status is achieved” (32 CFR 170.16(a)(1)(ii)(B)). The fix is a fresh assessment, which can produce a new Conditional status and a new 180-day clock, provided you still meet the POA&M eligibility rules in 32 CFR 170.21.
The short version
Three facts decide what happens next, and all three come from the regulation, not from opinion:
- Expiry is automatic. “If the POA&M is not successfully closed out within the 180-day timeframe, the Conditional CMMC Status for the information system will expire.” (32 CFR 170.21(b))
- Expiry does affect eligibility. A widely repeated belief in the supplier community is that letting a Conditional status lapse has no effect on future contracts. The rule text says the opposite: until a new CMMC Status is achieved, the organisation is ineligible for additional awards that require Level 2 (Self) or higher for that assessment scope. (32 CFR 170.16(a)(1)(ii)(B) for self-assessments; 170.17(a)(1)(ii)(B) for C3PAO assessments)
- You can start again. DoD’s own FAQ states that after a failed closeout “the Organization Seeking Assessment will have to begin again with a new assessment to achieve a CMMC Status.” A new self-assessment that scores at least 0.8 and leaves only POA&M-eligible requirements open produces a new Conditional status. (CMMC FAQ C-Q8; 32 CFR 170.21(a)(2))
What “standard contractual remedies” means in practice
DFARS 252.204-7021(d)(1)(i) requires the contractor to “have and maintain for the duration of the contract a current CMMC status” at the level the contracting officer inserted in the clause. The clause defines “current” for a Conditional status as “not older than 180 days” with a corresponding affirmation. Once your status expires, you no longer meet (d)(1). Paragraph (d)(5) is even more direct: “If the Contractor has a CMMC Status of Conditional, successfully close out a valid plan of action and milestones (32 CFR 170.21) to achieve a CMMC Status of Final.”
“Standard contractual remedies” is the government’s phrase for the normal tools a contracting officer already has: a cure notice, a show-cause letter, withholding, negative CPARS, declining to exercise an option, or, in the extreme, termination for default. DFARS 204.7503(c) tells contracting officers to check SPRS and not “exercise an option or extend the period of performance” unless the required current status is present. So even where nobody sends a letter, the expiry surfaces at the next option year.
The 48 CFR rule that put 7021 into contracts deliberately removed a proposed 72-hour duty to notify the contracting officer of a lapse. That removal does not make silence a safe strategy. The affirmation you signed in SPRS is a representation to the government, and the False Claims Act settlements of 2025 and 2026 (LOGZONE, $507,144, June 2026) were built on inaccurate cybersecurity representations. If you are inside a contract that carries 7021, a short factual note to the contracting officer before the expiry date is the defensible position. See CMMC and the False Claims Act.
Do not confuse two different clocks
| Item | CMMC Conditional Level 2 status | NIST SP 800-171 DoD Assessment score (DFARS 7019/7020) |
|---|---|---|
| Where it lives | SPRS, via CMMC eMASS (C3PAO) or direct entry (Self) | SPRS NIST SP 800-171 assessment module |
| Validity | 180 days from the Conditional CMMC Status Date, then expires unless closed out (32 CFR 170.21(b)) | 3 years; SPRS turns the entry red after three years (DFARS 252.204-7019(c)(1); SPRS Quick Entry Guide v4.0) |
| Open items | Only 1-point requirements may be on the POA&M (plus SC.L2-3.13.11 if encryption exists but is not FIPS-validated); six requirements are never allowed on it (32 CFR 170.21(a)(2)) | Any score below 110 is accepted; you declare a “date that all requirements are expected to be implemented” (DFARS 252.204-7019, Basic Assessment summary fields) |
| What happens at the date | Automatic expiry; ineligibility for new Level 2 awards until a new status | Nothing automatic. The declared date is a self-reported plan, not an expiry |
| Legal exposure | Affirmation of continuous compliance (32 CFR 170.22) | Accuracy of the score itself; DCMA can re-assess (DFARS 252.204-7020) |
Many suppliers asking this question are actually holding a 7019 score with a passed implementation date, not a CMMC Conditional status. If that is you, there is no 180-day expiry to manage. Update the SPRS entry with an accurate score and a realistic date, and remember that DCMA’s re-scoring of self-assessments is exactly what produced the LOGZONE settlement.
What to do in the last weeks of the window
1. Establish the real deadline
The clock starts on the Conditional CMMC Status Date, not on the day you posted the results. Count 180 calendar days. For a C3PAO assessment the closeout must also be posted to CMMC eMASS within that window (32 CFR 170.17(a)(1)(ii)(B)), so book the assessor with margin.
2. Check that you were ever eligible for Conditional
If any open item is worth 3 or 5 points (multifactor authentication, FIPS-validated encryption where no encryption exists, audit logging, and so on), or if any of the six excluded requirements is open, the assessment should not have produced a Conditional status at all. The correct outcome in SPRS is “No CMMC Status” (CMMC FAQ C-A10). Fix the record rather than run out the clock on a status you did not qualify for.
3. Never finalise a closeout with items still NOT MET
DoD’s FAQ is explicit: a POA&M Closeout Assessment “can only be finalized in the CMMC Enterprise Mission Assurance Support System (eMASS) one time,” and if one or more requirements are still NOT MET when it is finalised, “the Conditional CMMC Status will be terminated.” A premature closeout ends the status immediately; waiting for expiry at least gives you the remaining days. Close out only when every item is genuinely MET with evidence.
4. Sprint the 1-point items
By definition every legitimately POA&M’d item is a 1-point requirement. Most are policy, procedure and configuration work: media marking, session lock parameters, portable storage rules, security awareness records, maintenance logs. A focused two-to-three-week evidence sprint usually closes them. Use the SPRS score calculator to confirm which items remain and what they are worth.
5. If you will miss the date, plan the re-assessment, not the excuse
Let the Conditional status expire rather than finalising a failed closeout, then perform a complete new self-assessment (or book a new C3PAO assessment) as soon as the remaining items are fixed. A new assessment that meets 32 CFR 170.21(a)(2) creates a new Conditional status and a new 180-day window; one that scores 110 creates a Final status with a three-year validity. Submit the new affirmation in SPRS at the same time (32 CFR 170.22(a)(3)).
6. Tell the contracting officer, factually and early
One paragraph: which CMMC UID, the Conditional CMMC Status Date, which requirements remain open and why, the target date for the new assessment, and confirmation that CUI handling has not changed. DFARS 252.204-7021(e)(1) already requires you to report changes to CMMC UIDs; extending that habit to a lapse costs nothing and removes the “concealment” argument that whistleblower lawyers rely on.
Where CMMC stands in September 2026
On 13 July 2026 the Department announced “the immediate suspension of the Cybersecurity Maturity Model Certification (CMMC) Phase II requirements” while confirming that “All Phase I self-assessment requirements remain firmly in place.” A 3 September class deviation directed contracting officers to remove third-party assessment requirements from contracts while keeping self-attestation of NIST SP 800-171 compliance. The Conditional Level 2 (Self) mechanics described on this page sit inside Phase I and are unchanged. If your contract carries a Level 2 (C3PAO) requirement, ask the contracting officer in writing how the deviation applies to your award before you act on it.
Sources and clauses
- 32 CFR 170.16(a)(1)(ii)(B): expiry of Conditional Level 2 (Self), “standard contractual remedies,” ineligibility until a new status
- 32 CFR 170.17(a)(1)(ii)(B): same provisions for Conditional Level 2 (C3PAO), closeout posted to CMMC eMASS within 180 days
- 32 CFR 170.21: POA&M eligibility (0.8 score, 1-point items only, six excluded requirements) and 180-day closeout
- 32 CFR 170.22: affirmation after every assessment, after POA&M closeout and annually
- DoD CIO CMMC FAQ, Rev 2.3, July 2026: C-Q8 (closeout can be finalised once; failed closeout terminates the status; new assessment required), C-A10 (“No CMMC Status”)
- DFARS 252.204-7021 (NOV 2025): definition of “current,” (d)(1) maintain status for the duration, (d)(5) close out the POA&M, (e)(1) report CMMC UIDs
- DFARS 204.7502 and 204.7503: award with a Conditional status permitted for 180 days; contracting officers check SPRS before award, options and extensions
- 90 FR 43560, 10 September 2025: DFARS CMMC final rule, removal of the lapse-notification requirement
- 89 FR 83092, 15 October 2024: 32 CFR 170 final rule preamble, “At this point, standard contractual remedies will apply”
- DFARS 252.204-7019 and SPRS NIST SP 800-171 Quick Entry Guide v4.0: three-year currency of the 7019 score, planned implementation date
- Department of War release, 13 July 2026: suspension of CMMC Phase II; Phase I self-assessments remain
This page is general information, not legal advice. ITSECOPS is not affiliated with the Department of Defense. Contract-specific questions belong with your contracting officer.
FAQ
Can I get a second Conditional status after the first one expires?
Yes. The rule does not limit the number of assessments. After expiry, a new self-assessment (or C3PAO assessment) that scores at least 0.8 with only 1-point items open produces a new Conditional status and a new 180-day window. What you cannot do is extend or renew the original one.
Does an expired Conditional status affect contracts I already hold?
It can. DFARS 252.204-7021 requires you to maintain a current status for the duration of the contract, and 32 CFR 170.16 says standard contractual remedies apply if the status expires during performance. Whether the contracting officer acts is their decision, but the breach exists on the day of expiry.
My SPRS score is 92 with a planned completion date that has passed. Is that the same problem?
No. A DFARS 7019 NIST SP 800-171 score has no 180-day expiry; it stays current for three years. Update the entry with an accurate score and a realistic date. The risk there is accuracy, not timing: DCMA can re-score you, and inaccurate scores have led to False Claims Act settlements.
Should I finalise the closeout to “show progress” even if two items are still open?
No. A closeout can be finalised only once, and finalising it with any item NOT MET terminates the Conditional status immediately. Use the remaining days to close the items, or let the status expire and re-assess.
Twenty days left on the clock?
Book a working session with Gaurav Sengar: we confirm which requirements are still open, what evidence closes them fastest, and how to word the note to your contracting officer. Fixed scope, confidential, no obligation.