Updated October 2026

POA&M Cost for CMMC: $15K - $80K Closure

A Plan of Action and Milestones (POA&M) lets a CMMC Level 2 contractor receive conditional certification with documented open gaps, subject to a 180-day closure window. Not all controls qualify, and missing the window revokes certification entirely.

What qualifies vs what does not

POA&M-eligible (typical)

Lower-impact documentation gaps
Specific NIST SP 800-171 medium-impact requirements with mitigating controls in place
Awareness training rollout completion
Configuration baseline finalisation across less-critical assets
Policy ratification timing gaps

Not POA&M-eligible (showstoppers)

MFA on privileged accounts (high-impact)
FIPS-validated cryptography for CUI in transit and at rest
Audit logging of CUI access
Incident response capability
Most high-impact (5-point SPRS deduction) requirements

Reference: 32 CFR Part 170 final rule, DoD CIO CMMC programme office guidance, and the DoD Assessment Methodology (DAM). The qualifying-control subset can evolve; verify against current programme-office guidance before assuming POA&M eligibility.

The 180-day window timeline

Day 0

C3PAO issues conditional certification with documented POA&M items. Contractor enters certified status for solicitation eligibility.

Day 0-60

Remediation execution. Tooling deployments, configuration updates, evidence collection for closure.

Day 60-120

Evidence package finalisation. Schedule C3PAO closure assessment.

Day 120-150

C3PAO closure assessment. Typically narrower scope than the full Level 2 assessment; focused on POA&M items only.

Day 180

Hard deadline. Closure verified: full Level 2 certification. Closure not verified: conditional certification revoked.

POA&M closure cost composition

Remediation work

$10K - $50K

Tooling acquisition, configuration, documentation. Highly variable with the count and complexity of POA&M items.

C3PAO closure verification

$5K - $30K

Re-engagement fee for the C3PAO to verify POA&M closure. Narrower scope than the full Level 2 assessment.

No closure-cost figure is published by anyone, so the line items above are drivers rather than a priced total. The two that compound are the number of open items and whether closure needs the assessor back on the clock; price the re-engagement in hours in your original Statement of Work.

Cost of missing the window

Conditional certification revocation triggers full reassessment costs, not just closure-verification fees:

Loss of certified status, with contract-eligibility consequences during the gap.
Fresh full C3PAO Level 2 assessment required (unpublished fee; DoD models $31,234 for a small entity, $52,056 above that).
Re-remediation labour to close all POA&M items before the new assessment.
Potential contractor reputation effect with prime contractors and DoD acquisition officers.

This is why scoping POA&M items conservatively at the original C3PAO engagement is the cost-minimising strategy. Pre-closure on as many in-progress controls as possible before signing the engagement letter.

Frequently asked questions

What is a POA&M in CMMC?

A Plan of Action and Milestones (POA&M) documents an unimplemented or partially implemented control along with the corrective action, owner, and target closure date. Under 32 CFR Part 170, CMMC Level 2 assessments allow conditional certification when remaining gaps are documented in a POA&M, subject to specific limits on which controls can be POA&M'd and how long.

Which controls qualify for a POA&M?

Not all. Certain critical controls are considered showstoppers and cannot be deferred via POA&M: multi-factor authentication on privileged accounts, FIPS-validated cryptography for CUI in transit and at rest, audit logging of access to CUI, and incident response capability. The 32 CFR Part 170 final rule restricts POA&M to a defined subset; high-impact requirements (5-point deductions in the SPRS score) generally do not qualify.

What is the POA&M closure window?

180 days from the conditional certification date. The contractor must close the documented gaps within that window or risk losing the conditional certification. A second C3PAO assessment is typically required to confirm closure; this triggers re-engagement fees.

How much does POA&M remediation typically cost?

Nobody publishes a figure for this, and it is highly variable, so treat any single number with suspicion. The cost has two parts and they behave differently. The remediation work itself (tooling, configuration, documentation) is priced by whatever the open item actually requires, and is the dominant line. The C3PAO re-engagement to verify closure is assessor hours at the firm agreed rate, so it scales with how many items need re-examining rather than with your headcount. Get the closure verification priced in hours in the original Statement of Work, before you know whether you will need it, because that is the only point at which you have any leverage over it.

What happens if I miss the 180-day window?

Conditional certification is revoked. The contractor loses CMMC certified status and may be excluded from new DoD solicitations requiring Level 2 until a fresh full C3PAO assessment is completed. The reassessment incurs full C3PAO fees, not just the closure-verification cost. This is why scoping POA&M items conservatively at the original assessment is critical.

Level 2 cost overview C3PAO cost Remediation cost