Can I put a control on a POA&M and still get CMMC certified?
Sometimes. Conditional certification exists, but it is narrow: you need a score at or above the programme's minimum threshold, only lower-weighted practices are eligible to sit on a POA&M, and the highest-weighted practices must be met outright. The POA&M must then be closed within 180 days or the conditional status lapses.
The consequence people miss is the sequencing. Because the heaviest-weighted practices cannot be deferred, discovering one of those is unmet a month before assessment is not a POA&M problem — it is a schedule problem.
Treat the weighting as a prioritisation map rather than a scoring curiosity. Work the ineligible practices first regardless of how inconvenient they are, because they are the ones with no fallback.
Sources
- 32 CFR Part 170 — conditional status and POA&M closeout
- DoD Assessment Methodology, NIST SP 800-171 scoring
Drafted with the tools on this site, then checked against the sources above by a practitioner before publishing. Reviewed 2026-08-07. Found something wrong? It should be corrected — this page is only worth as much as its accuracy.