Which CMMC Requirements Are Considered Critical and Cannot Be on a POA&M?

No POA&M Allowed for Critical Requirements

The CMMC program allows limited use of POA&Ms for some requirements, but critical requirements must be fully implemented at the time of your assessment. You cannot receive a conditional certification with these on a POA&M.

Why Certain Requirements Are Critical

Critical requirements represent the baseline security controls that, if absent, would leave your environment fundamentally vulnerable. Think of these as the "non-negotiable" security measures.

POA&M Rules Under CMMC

• POA&Ms are only allowed for non-critical requirements at Levels 2 and 3
• Level 1 does not permit POA&Ms — all 15 requirements must be met
• POA&M items must be closed within 180 days of the assessment
• A POA&M closeout assessment verifies remediation
• Maximum score reduction per POA&M item applies

Practical Advice

Don't plan your assessment timeline around POA&M use as a strategy. Assessors may view heavy POA&M reliance unfavorably, and failing to close POA&M items within 180 days results in loss of your CMMC status. Focus on implementing all requirements — especially critical ones — before scheduling your assessment.