Updated May 2026

POA&M Cost for CMMC: $15K - $80K Closure

A Plan of Action and Milestones (POA&M) lets a CMMC Level 2 contractor receive conditional certification with documented open gaps, subject to a 180-day closure window. Not all controls qualify, and missing the window revokes certification entirely.

What qualifies vs what does not

POA&M-eligible (typical)

Lower-impact documentation gaps
Specific NIST SP 800-171 medium-impact requirements with mitigating controls in place
Awareness training rollout completion
Configuration baseline finalisation across less-critical assets
Policy ratification timing gaps

Not POA&M-eligible (showstoppers)

MFA on privileged accounts (high-impact)
FIPS-validated cryptography for CUI in transit and at rest
Audit logging of CUI access
Incident response capability
Most high-impact (5-point SPRS deduction) requirements

Reference: 32 CFR Part 170 final rule, DoD CIO CMMC programme office guidance, and the DoD Assessment Methodology (DAM). The qualifying-control subset can evolve; verify against current programme-office guidance before assuming POA&M eligibility.

The 180-day window timeline

Day 0

C3PAO issues conditional certification with documented POA&M items. Contractor enters certified status for solicitation eligibility.

Day 0-60

Remediation execution. Tooling deployments, configuration updates, evidence collection for closure.

Day 60-120

Evidence package finalisation. Schedule C3PAO closure assessment.

Day 120-150

C3PAO closure assessment. Typically narrower scope than the full Level 2 assessment; focused on POA&M items only.

Day 180

Hard deadline. Closure verified: full Level 2 certification. Closure not verified: conditional certification revoked.

POA&M closure cost composition

Remediation work

$10K - $50K

Tooling acquisition, configuration, documentation. Highly variable with the count and complexity of POA&M items.

C3PAO closure verification

$5K - $30K

Re-engagement fee for the C3PAO to verify POA&M closure. Narrower scope than the full Level 2 assessment.

Total typical POA&M closure cost: $15K-$80K. Cluster contractors with multiple POA&M items at the upper end of the band.

Cost of missing the window

Conditional certification revocation triggers full reassessment costs, not just closure-verification fees:

Loss of certified status, with contract-eligibility consequences during the gap.
Fresh full C3PAO Level 2 assessment required ($30K-$200K+).
Re-remediation labour to close all POA&M items before the new assessment.
Potential contractor reputation effect with prime contractors and DoD acquisition officers.

This is why scoping POA&M items conservatively at the original C3PAO engagement is the cost-minimising strategy. Pre-closure on as many in-progress controls as possible before signing the engagement letter.

Frequently asked questions

What is a POA&M in CMMC?

A Plan of Action and Milestones (POA&M) documents an unimplemented or partially implemented control along with the corrective action, owner, and target closure date. Under 32 CFR Part 170, CMMC Level 2 assessments allow conditional certification when remaining gaps are documented in a POA&M, subject to specific limits on which controls can be POA&M'd and how long.

Which controls qualify for a POA&M?

Not all. Certain critical controls are considered showstoppers and cannot be deferred via POA&M: multi-factor authentication on privileged accounts, FIPS-validated cryptography for CUI in transit and at rest, audit logging of access to CUI, and incident response capability. The 32 CFR Part 170 final rule restricts POA&M to a defined subset; high-impact requirements (5-point deductions in the SPRS score) generally do not qualify.

What is the POA&M closure window?

180 days from the conditional certification date. The contractor must close the documented gaps within that window or risk losing the conditional certification. A second C3PAO assessment is typically required to confirm closure; this triggers re-engagement fees.

How much does POA&M remediation typically cost?

Highly variable, but practitioner reports cluster around $15K-$80K for typical Level 2 POA&M closure, depending on the number and complexity of items. The dominant cost lines are the remediation work itself (tooling, configuration, documentation) and the C3PAO re-engagement to verify closure (typically $5K-$30K depending on scope).

What happens if I miss the 180-day window?

Conditional certification is revoked. The contractor loses CMMC certified status and may be excluded from new DoD solicitations requiring Level 2 until a fresh full C3PAO assessment is completed. The reassessment incurs full C3PAO fees, not just the closure-verification cost. This is why scoping POA&M items conservatively at the original assessment is critical.

Level 2 cost overview C3PAO cost Remediation cost