Terms / Assessment
Temporary deficiency
A known gap with a fix under way, documented in an operational plan of action. Handled properly, it is assessed as met.
Also called temporary deficiencies.
Official Source Material
Temporary deficiency means a condition where remediation of a discovered deficiency is feasible, and a known fix is available or is in process. The deficiency must be documented in an operational plan of action. A temporary deficiency is not based on an 'in progress' initial implementation of a CMMC security requirement but arises after implementation. A temporary deficiency may apply during the initial implementation of a security requirement if, during roll-out, specific issues with a very limited subset of equipment is discovered that must be separately addressed. There is no standard duration for which a temporary deficiency may be active.
Source: 32 CFR 170.4, eCFR text current as of September 17, 2026
Practitioner Guidance
What it means in practice
A temporary deficiency arises after implementation, not instead of it.
This is the sentence that decides most arguments about the term. You implemented the control. Something then broke, drifted, or needed a patch. That is a temporary deficiency. A requirement you never implemented is not one, however sincerely you intend to get to it. The rule says so directly.
Documented properly, it is assessed as met.
Section 170.24(b)(1)(ii) treats a temporary deficiency as met when it is appropriately addressed in an operational plan of action, which means the plan shows deficiency reviews and progress toward correction. That is a meaningful protection during an assessment, and it depends entirely on the document existing beforehand.
An operational plan of action is not a POA&M, and the difference matters.
A POA&M comes out of an assessment and runs on a 180 day clock. An operational plan of action is your own running record of temporary problems, required by CA.L2-3.12.2, with no fixed timeline. The rule defines them separately and deliberately. Keep both, and do not let a tool merge them.
There is no fixed duration, and that is not permission to let it run.
The rule says no standard duration applies, and it also expects reviews and progress. A deficiency open for a year with no movement is not temporary, and an assessor reading the reviews will see that. The document protects you only while it tells a true story.
What falls short
- A requirement never implemented, recorded as a temporary deficiency. The definition excludes an initial implementation in progress.
- An operational plan of action with entries and no review dates. Progress is part of what makes the finding met.
- A deficiency discovered during the assessment and written up on the spot. The plan is expected to exist already.
Edge cases
- A rollout finds a problem on a very limited subset of equipment. The rule allows a temporary deficiency during initial implementation in exactly that case.
- Validated cryptography needs a patch and the patched version is not yet validated. The rule gives this as its own example.
- The fix is not feasible at all and the condition is permanent. That is an enduring exception, which is documented differently.
Over-engineering
- A formal change process for every temporary deficiency. A dated entry, an owner, a review, and evidence of progress is what is asked.
- A separate system for operational plans of action. A maintained document meets the requirement.