Conditional Status
Also known as: Conditional CMMC Status, Conditional Level 2 (Self)
Conditional status is a CMMC Level 2 result a contractor can achieve with a score of 88 or better out of 110 when the remaining gaps are all eligible for a Plan of Action and Milestones (POA&M). It lets a contractor be treated as compliant while it closes those items, which it must do within 180 days to convert to Final status.
In more detail
Under 32 CFR 170.21, a Level 2 assessment that is not perfect can still support award if the score is at least 88 and every open requirement is POA&M eligible. A short set of requirements can never be placed on a POA&M, and any requirement worth 5 points cannot be either, so those must be fully met regardless of score.
Conditional status is time-boxed. The POA&M items must close and be verified within 180 days, at which point the status becomes Final. Miss the window and the status lapses.
Related terms
- Final Status
Final status is a CMMC Level 2 result in which all 110 requirements of NIST SP 800-171 are fully met, with no open POA&M items. A contractor reaches Final status either by passing outright or by closing every POA&M item from a Conditional result within the 180 day window.
- Plan of Action and Milestones
A Plan of Action and Milestones (POA&M) is a written document that identifies security weaknesses, the corrective actions planned to address them, and the milestones for doing so. POA&Ms are permitted at CMMC Level 2 (for limited categories of controls, with closure timelines) but are NOT permitted at Level 1, Level 1 requires full implementation before affirmation.
- CMMC Level 2
CMMC Level 2 is the middle CMMC certification tier, covering contractors who handle Controlled Unclassified Information (CUI). It requires implementing all 110 controls of NIST SP 800-171 and undergoing either a self-assessment or a triennial assessment by a CMMC Third-Party Assessment Organization (C3PAO) depending on the program's prioritization. DoD suspended CMMC Phase 2 on July 13, 2026, which paused the phased arrival of the C3PAO assessment requirement pending a program review, while the obligations that drive Level 2 in the first place, DFARS 252.204-7012 and NIST SP 800-171, are unaffected.
- SPRS Score
An SPRS score is a numerical NIST SP 800-171 self-assessment score, ranging from a maximum of +110 down to a possible -203, calculated using the DoD Assessment Methodology by subtracting weighted point values for unimplemented controls. SPRS scores are required at CMMC Level 2 and above, Level 1 is binary MET/NOT MET with no numerical score.