CMMC Conditional Certification: What an 88 Gets You, and the 180-Day Clock

Why 88 Is the Line

A CMMC Level 2 assessment scores you against all 110 NIST SP 800-171 requirements using the DoD Assessment Methodology, where the maximum is 110. The methodology allows a Plan of Action and Milestones (POA&M) for a passing assessment only when your score is at least 80% of that maximum — a score of 88. Hit 88 or above with an eligible set of remaining gaps and you can earn a ConditionalLevel 2 status. Fall below 88 and a POA&M is not permitted at all: you have to remediate up to at least 88 before a conditional status is even on the table.

Not Everything Can Ride a POA&M

Clearing 88 is necessary but not sufficient, because the score is not the only rule. Under 32 CFR 170.21, the methodology bars the highest-impact requirements from a POA&M — those have to be fully met to certify. Lower-weighted gaps can be scheduled; the most critical controls cannot be deferred.

In practice that means two companies with the identical score of 88 can have very different paths:

• Must-meet controls. The heavily weighted, most security-significant requirements — multifactor authentication and FIPS-validated encryption are classic examples — generally have to be implemented, not promised. If one of those is your gap, an 88 alone will not certify you.
• POA&M-eligible gaps. Lower-weighted requirements can be placed on the POA&M and closed inside the window.

The 180-Day Clock to Final Status

Conditional is not the finish line — it is a countdown. Once a Level 2 certification assessment leaves you with an open POA&M, you have 180 days to close every item on it. A POA&M close-out assessment then verifies the remediation and converts your Conditional status to Final. Miss the window and the conditional status does not become final — you do not get an open-ended extension.

So the honest way to read a conditional result is: you are certified enough to be considered, and you have six months to make it permanent. That clock should drive your remediation plan from day one, not get discovered at day 150.

How to Plan Backward From It

Treat 88 and the 180-day window as the two anchors of your remediation plan:

• Measure first. Get an honest score and a gap list against all 110 requirements, with each gap tagged must-fix or POA&M-eligible. Without that split you cannot tell whether you are 88-and-certifiable or 88-and-stuck.
• Clear the must-meet controls before the assessment. These are not negotiable, so do them first — they are the items that quietly block certification at any score.
• Schedule the rest into the 180 days. Assign an owner and a target date to every POA&M item and track it to done, so the close-out assessment is a formality, not a scramble.

For the mechanics of the score itself — how points are deducted and self-reported — see our SPRS score guide, and for the two documents that carry your gaps and your plan, see SSP and POA&M explained.

Know Your Number, and Your Path

The fastest way to know whether you are within reach of 88 — and which gaps are must-fix versus schedulable — is an honest assessment against all 110 requirements. The Dragonfli Group CMMC Accelerator gives you an estimated SPRS score, separates your must-fix gaps from your POA&M-eligible ones, and lays out the path to a certifiable score, each reviewed by a CMMC Registered Practitioner.