SSP and POA&M requirements for CMMC

3.12.1 — Periodically assess the security controls in organizational systems to determine if the controls are effective in their application

This control requires organizations to periodically assess the security controls in organizational systems to determine if the controls are effective in their application. It is part of the Security Assessment family and is one of the 110 NIST SP 800-171 Rev. 2 requirements DFARS 252.204-7012 obliges contractors handling CUI to implement — the requirement set CMMC Level 2 assesses. Implementing it protects CUI and supports the score you self-report to SPRS.

3.12.2 — Develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems

This control requires organizations to develop and implement plans of action designed to correct deficiencies and reduce or eliminate vulnerabilities in organizational systems. It is part of the Security Assessment family and is one of the 110 NIST SP 800-171 Rev. 2 requirements DFARS 252.204-7012 obliges contractors handling CUI to implement — the requirement set CMMC Level 2 assesses. Implementing it protects CUI and supports the score you self-report to SPRS.

3.12.3 — Monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls

This control requires organizations to monitor security controls on an ongoing basis to ensure the continued effectiveness of the controls. It is part of the Security Assessment family and is one of the 110 NIST SP 800-171 Rev. 2 requirements DFARS 252.204-7012 obliges contractors handling CUI to implement — the requirement set CMMC Level 2 assesses. Implementing it protects CUI and supports the score you self-report to SPRS.

3.12.4 — Develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systemsthe SPRS gate — 3.12.4

This control requires organizations to develop, document, and periodically update system security plans that describe system boundaries, system environments of operation, how security requirements are implemented, and the relationships with or connections to other systems. It is part of the Security Assessment family and is one of the 110 NIST SP 800-171 Rev. 2 requirements DFARS 252.204-7012 obliges contractors handling CUI to implement — the requirement set CMMC Level 2 assesses. Implementing it protects CUI and supports the score you self-report to SPRS.

Level 1: no POA&M, period

“To satisfy CMMC Level 1 requirements, a POA&M is not allowed.”

§170.21

The 17 Level 1 practices must all be met at assessment time. There is no conditional path.

Level 2 and 3: allowed, above a floor

“If the minimum score is achieved on the assessment (equal to 80% of the maximum score)…”

§170.16, §170.18 (conditional status eligibility)

A POA&M only exists inside a conditional status — and conditional status requires scoring at least 80% of the maximum. Below that, there is nothing to defer into; the assessment simply does not pass.

Not everything can be deferred

“Section 170.21 identifies the Level 2 security requirements that cannot have a POA&M and must be fully met at the time of the assessment.”

§170.21(a)(2)

The rule enumerates specific requirements that must be MET on assessment day regardless of score. Read the list in the rule text before you plan a deferral — do not assume a requirement is deferrable because it is hard.

The 180-day clock, and what expiry means

“All POA&Ms must be closed within 180 days of the Conditional CMMC Status Date. … if a POA&M closeout assessment does not find that all requirements have been met by the end of 180 days, then the CMMC Status of Conditional Level 2 (Self) or Conditional Level 2 (C3PAO) will expire. At this point, standard contractual remedies will apply.”

§170.21, §170.16

Expiry is not a paperwork event — it removes the status your contract eligibility rests on.