Updated September 29, 2026
You scored your own company at 94, your customer wants to know your "status," and someone asked whether "Conditional" counts. It does, but only if your open gaps are the right kind. Without a status, you can't be awarded a contract that requires one, whatever your score says.
Some background in one paragraph. Under CMMC Level 2 (Self), you check your company against 110 security requirements and post the result in SPRS, the Defense Department's Supplier Performance Risk System. A perfect score is 110. Each unmet requirement subtracts 1, 3, or 5 points depending on how serious it is. A POA&M (plan of action and milestones) is your written list of what's still open and when you'll fix it.
You get Final status at 110, with nothing open. You get Conditional status at 88 or above, but only if every requirement still open is one the rules allow on a POA&M, and you then have 180 days to close all of them. Most companies that miss Conditional have plenty of points. What they have is one open gap the rules won't let onto a POA&M.
SPRS enforces this for you. Per the SPRS quick-entry guide, if any open requirement can't be on a POA&M, the status is "No CMMC Status regardless of score."
Test each open requirement
Take every requirement you marked not met and run it through this table, top to bottom. The table is 32 CFR 170.21, the rule itself, on one page. The middle column is for whoever did your scoring.
| What's still open | Requirement number | Can it stay open under Conditional? |
|---|---|---|
| Anything worth 5 points, such as limiting access to approved people, keeping audit logs, multi-factor login (no MFA at all), or fixing security flaws on time | 3.1.1, 3.3.1, 3.5.3, 3.14.1, and 40 others | No. Fix it first. |
| Anything worth 3 points, such as limiting admin rights, tracing actions to a person, or MFA only partly done | 3.1.5, 3.3.2, 3.5.3 (partial), and others | No. |
| CUI (controlled unclassified information: the drawings and specs the government marks sensitive) is encrypted, but with software that hasn't passed the government's FIPS encryption test | 3.13.11 at −3 | Yes. The only 3-point exception. |
| Connections to outside systems, like personal devices or partner networks, aren't controlled | 3.1.20 | No, even though it's 1 point |
| Nobody checks what goes on your public website | 3.1.22 | No |
| Visitors aren't escorted and watched | 3.10.3 | No |
| No log of who entered the building | 3.10.4 | No |
| Keys, badges, and door codes aren't tracked | 3.10.5 | No |
| No System Security Plan (SSP), the document describing how you protect CUI | 3.12.4 | No. Without it there's no assessment. |
| Any other 1-point requirement | Yes |
Then check the total is at least 88. If every row passes, you can claim Conditional. If one row says no, you have No CMMC Status until it's fixed, however high the score.
Two shops at 100 show how this plays out. One never turned on activity logging on its file server, a 5-point item, and has no status. The other lost its ten points on 1-point items like locking an account after repeated bad passwords and locking an idle screen, none of them on the excluded list, and is Conditional. Same score, opposite answer to the customer.
The 180 days
The clock starts on your Conditional status date in SPRS. Within 180 days you close every POA&M item, re-check yourself "in the same manner as the initial self-assessment," and your Affirming Official, the senior person who signs for the company, affirms again. That makes the status Final. Miss the date and Conditional expires. There is no extension, and moving a due date in your own tracker doesn't change the one in SPRS.
Plan it backward. Leave the last month for the final re-check and the SPRS entry. Give the fixes at least a month of running before that, because a log setting turned on the day before has no logs to show. That leaves roughly the first 90 days to do the work. If a C3PAO (an accredited third-party assessment firm, still open for business during the pause) gave you the Conditional status, the final check is a C3PAO assessment instead, on the same 180 days. The affirmation →
Write each POA&M item as a finish line someone can check. "Buy logging license" is a task. "Firewall, VPN, and Microsoft 365 send sign-in events to the log server, kept 90 days, reviewed weekly by the IT lead" is something you can close. Keep your wider to-do list somewhere else. Only eligible items belong on the POA&M.
If you're deciding whether to claim Conditional now or finish first, claim it only when the remaining items are small, owned by a named person, and already underway. A 180-day clock on work nobody has started just produces an expired status. What to fix first → · How the score is calculated →