Terms / Certification
Conditional certification
The status you hold when your assessment left items on a POA&M. It lasts 180 days and expires if the closeout does not happen.
Also called Conditional CMMC Status, conditional status.
Official Source Material
The OSA has achieved the CMMC Status of Conditional Level 2 (Self) if the Level 2 self-assessment results in a POA&M and the POA&M meets all the CMMC Level 2 POA&M requirements listed in § 170.21(a)(2).
Source: 32 CFR 170.16(a)(1)(ii), eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
A conditional status is a real status with a deadline attached.
You finished the assessment, some requirements were not met, and those items went onto a POA&M that satisfies the limits in 170.21. You may perform the contract. Section 170.16(a)(1)(ii) states this for a self-assessment and 170.17(a)(1)(ii) states it for a certification assessment. You have 180 days from the status date to close every item and pass a closeout assessment. Miss it and the conditional status for that system expires.
The 180 days run from the status date, not from when you start work.
The clock begins when the results reach SPRS. Closing the items is only half of it. A closeout assessment must confirm the closure inside the window, which means booking a C3PAO for a certification assessment, or performing a closeout self-assessment. Schedule the closeout when the clock starts, not when the work finishes.
Not every gap can be carried, so a conditional status is not a fallback plan.
Section 170.21 requires your score divided by 110 to be at least 0.8. It bars any requirement worth more than one point, apart from the encryption requirement in a specific case. It also names six requirements that may never appear. Do not arrive at an assessment hoping to carry the difference.
A conditional status is current for 180 days under the contract clause too.
DFARS 252.204-7021 defines current as not older than 180 days for a conditional status, with an affirmation behind it. That matters during performance, because the clause requires you to hold a current status for the duration of the contract.
What falls short
- A closeout booked near the end of the window. Assessment organizations have limited availability and the deadline does not move.
- Items closed by assertion. The closeout assessment re-examines those requirements against the same objectives.
- An assumption that the status renews. It expires, and closing an item afterwards does not revive it.
Edge cases
- You close every item in a month. The status stays conditional until the closeout confirms it, so schedule the closeout early.
- Your status becomes final after a successful closeout. The status date stays the date of the conditional status; a new one is not set.
- You are at Level 1. No plan of action is permitted, so no conditional status exists there.
Over-engineering
- A programme to close every weakness during the 180 days. Close the items on the plan, and put the rest in your own plan of action.
- A second assessment organization engaged for the closeout. The closeout assesses only the items that were not met.