Terms / Assessment
Not applicable
A finding that a requirement or objective does not apply to your environment. It counts the same as met, and it needs a written reason.
Also called N/A, not applicable finding.
Official Source Material
Not Applicable (N/A). A security requirement and/or objective does not apply at the time of the CMMC assessment. For example, Public-Access System Separation (SC.L2-3.13.5) might be N/A if there are no publicly accessible systems within the CMMC Assessment Scope. During an assessment, an assessment objective assessed as N/A is equivalent to the same assessment objective being assessed as MET.
Source: 32 CFR 170.24(b)(3), eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
A not applicable finding scores the same as met, which makes it worth getting right.
Section 170.24(b)(3) says so plainly. This is not a gap and it is not a deduction. Where a requirement genuinely does not apply to your environment, recording it correctly protects your score. Where it is claimed loosely, it is the finding most likely to be reversed.
The test is your environment at the time of the assessment.
The rule gives its own example: separating publicly accessible systems may not apply when your scope contains none. The reasoning is always about what exists in the assessed environment, never about what you find inconvenient or expensive. SC.L2-3.13.5 is the example the rule itself gives. Write the reason in your system security plan so the assessor reads it before asking.
Not applicable is decided per objective, not only per requirement.
An assessment objective can be not applicable while the rest of its requirement applies normally. That precision helps you. It also means the reason you record should name the objective it covers.
An adjudication from the DoD Chief Information Officer is a different thing, and it belongs in the plan.
The Department may have already adjudicated that a requirement is not applicable to you, or that an alternative measure is equally effective. Section 170.24 requires that adjudication to appear in your plan to be considered during an assessment. Keep the letter, and put it in the document rather than a drawer.
What falls short
- A requirement marked not applicable because you have not implemented it. That is a gap and it scores as not met.
- A claim with no reason recorded. The reason is what makes the finding survive review.
- Wireless requirements marked not applicable while a wireless network exists anywhere in the scope. The assessor looks.
Edge cases
- Your environment changes and the requirement starts to apply. The finding was correct at the time and is not correct now, so treat it as a change to your plan.
- You have no publicly accessible systems today and expect to add one. Record the finding honestly now and revisit it when you build.
- A provider performs the function rather than you. That is inheritance, not a not applicable finding.
Over-engineering
- A legal memorandum justifying a not applicable finding. A clear paragraph naming the objective and the reason is what the plan needs.
- Avoiding the finding entirely and implementing something you do not need. The rule provides for this deliberately.