CMMC Conditional Certification Explained

Conditional certification is the path for organizations that pass the C3PAO assessment with all critical practices met but have a small number of POA&M-eligible practices still open. Instead of failing, you receive a conditional certificate valid for 180 days, during which you must close all POA&M items.

If you close everything within 180 days and the C3PAO verifies closure, your certificate converts to a full three-year certification. If you miss the 180-day deadline, the conditional certificate expires and you have to start over.

The mechanism balances two goals. First, it does not punish organizations that are 95% there with a full assessment retry. Second, it forces real closure within a tight timeline so conditional certifications do not turn into permanent partial implementations.

For the full CMMC framework rules, including which specific practices are eligible, read the CMMC Assessment Process guide.

Most NIST 800-171 practices are eligible for POA&M deferral under conditional certification, but several are explicitly excluded. The excluded practices are the highest-weight ones that protect CUI most directly. They must be fully met at assessment time:

• 3.1.20: Verify and control external system connections (5 points)
• 3.1.22: Control public information posting (5 points)
• 3.5.3: Multi-factor authentication for privileged accounts (5 points)
• 3.13.11: Use FIPS-validated cryptography for CUI (5 points)

Additionally, you cannot have more than a certain number of points open on POA&M and still qualify. The threshold has shifted in DoD guidance, but the practical rule of thumb: aim for an SPRS score of at least 88 to be a credible candidate for conditional certification.

Run the math on the SPRS calculator before the assessment. If your projected score with all POA&M items as not-met is below 88, conditional certification is not realistic. Remediate further before booking.

The 180-day clock starts on the date the conditional certificate is issued, not the date of the on-site assessment. The two dates can be 4-8 weeks apart because of the C3PAO quality review process.

During the 180 days, you need to:

1. Close every POA&M item with verifiable evidence
2. Update the SSP narratives to reflect the closed state
3. Update the SPRS score to the post-closure number
4. Prepare the closure evidence package for the C3PAO
5. Schedule a closure verification engagement with the C3PAO

The closure verification is a smaller engagement than the original assessment. It focuses only on the POA&M items. The assessor reviews evidence, may interview personnel responsible for the closures, and confirms each item is closed. Plan 1-3 days depending on the number of items.

Build the closure plan immediately after receiving conditional certification. Day 1 of the 180 should be a planning day, not a denial-and-stall day.

For each POA&M item, the closure evidence package must include:

• Description of the original gap: What was not met at assessment
• Implementation summary: What you changed in the environment
• Evidence artifacts: Configuration screenshots, policy documents, training records, log samples, technical test results
• Verification statement: How you confirmed the closure works (e.g., audit log shows the new control firing)
• Date of closure: When the closure was completed and verified

Quality matters more than quantity. A single screenshot showing MFA enforced for the privileged group with a date stamp closes the practice. Ten pages of policy text without configuration evidence does not.

The C3PAO will sample evidence during the closure verification, not review every item end-to-end. But they will spot-check the items they consider highest risk. Treat every closure package as if it might be the one they audit deeply.

Missing the 180-day deadline is the worst outcome short of failing the original assessment. Specifically:

• The conditional certificate expires at day 181
• You lose CMMC Level 2 status and contracts requiring it become at risk
• You have to start the assessment process from scratch (new C3PAO engagement, new on-site)
• The cost is essentially a new assessment fee, not a partial

Mitigation steps if you see closure slipping:

1. Accelerate the most overdue items by reallocating resources
2. Communicate with the C3PAO at day 90 if you see risk to the deadline
3. Ask if any items can be re-categorized as already closed with stronger evidence
4. Schedule the closure verification at day 150 even if not all items are closed, to get a status check

The DoD does not extend the 180-day deadline. There is no discretionary grace period. Build the closure plan with 30 days of buffer, not 30 days of optimism.