Final Status
Also known as: Final CMMC Status, Final Level 2 (Self)
Final status is a CMMC Level 2 result in which all 110 requirements of NIST SP 800-171 are fully met, with no open POA&M items. A contractor reaches Final status either by passing outright or by closing every POA&M item from a Conditional result within the 180 day window.
Related terms
- Conditional Status
Conditional status is a CMMC Level 2 result a contractor can achieve with a score of 88 or better out of 110 when the remaining gaps are all eligible for a Plan of Action and Milestones (POA&M). It lets a contractor be treated as compliant while it closes those items, which it must do within 180 days to convert to Final status.
- Plan of Action and Milestones
A Plan of Action and Milestones (POA&M) is a written document that identifies security weaknesses, the corrective actions planned to address them, and the milestones for doing so. POA&Ms are permitted at CMMC Level 2 (for limited categories of controls, with closure timelines) but are NOT permitted at Level 1, Level 1 requires full implementation before affirmation.
- CMMC Level 2
CMMC Level 2 is the middle CMMC certification tier, covering contractors who handle Controlled Unclassified Information (CUI). It requires implementing all 110 controls of NIST SP 800-171 and undergoing either a self-assessment or a triennial assessment by a CMMC Third-Party Assessment Organization (C3PAO) depending on the program's prioritization. DoD suspended CMMC Phase 2 on July 13, 2026, which paused the phased arrival of the C3PAO assessment requirement pending a program review, while the obligations that drive Level 2 in the first place, DFARS 252.204-7012 and NIST SP 800-171, are unaffected.