Conditional CMMC Level 2: can you get certified with open gaps?

Short answer: yes. Under the CMMC Program rule (32 CFR 170), a C3PAO can issue a Conditional Level 2 certification when you meet a minimum score with a limited set of gaps parked on a Plan of Action & Milestones (POA&M) — provided you close them within 180 days. But the rule is specific about how low you can go and which requirements you can never defer. With Phase 2's November 10, 2026 assessment requirement approaching, here is exactly how conditional certification works.

The 88-point floor

You do not need a perfect 110 to walk out of an assessment with a certificate. The rule allows a Conditional Level 2 result at a minimum score, with the rest of your gaps on a POA&M — but only certain 1-point requirements are POA&M-eligible, and the conditional minimum works out to roughly the 88-point threshold. Score below that, or try to defer a higher-weighted control, and the POA&M will not carry you. The full POA&M eligibility rules lay out the conditional minimum and exactly which deductions you are allowed to defer.

What you can never put on a POA&M

A short list of requirements is never POA&M-eligible — they must be fully met before an assessment can close. The clearest example is requirement 3.12.4, the System Security Plan: without a current SSP the assessment cannot be completed at all, and it can never sit on a POA&M. It is also the single longest-lead artifact, so start it first. There are six requirements that can never be deferred, plus the 3.13.11 (FIPS-validated cryptography) exception — the POA&M guide names each one so you know what has to be closed before assessment day, not after.

The 180-day clock, and when it starts

A Conditional certification becomes a Final certification only when a follow-up review confirms every POA&M item is closed — and you have 180 days from the assessment to get there. Miss the window and the conditional status lapses. That is why sequence matters: close the must-fix gaps first, then park only genuine, low-weight items on the POA&M with realistic milestones you can actually hit.

Know your number before you book the assessor

All of this assumes you know your real score. The deductions are defined, not negotiable — the figure runs from 110 down to a floor of −203, every point following the published DoD Assessment Methodology. Run the free Muster Score to see which requirements are costing you and which are POA&M-eligible, with no signup and no CUI in the tool. Then check the full Phase 2 timeline and work backward from a C3PAO calendar that already runs 6–9 months deep.

One constant runs through all of it: what Muster produces are drafts you review, approve, and attest to. We do not certify you and do not attest for you — the judgment stays yours, which is what keeps an accurate POA&M from turning into a False Claims Act problem.