CMMC Compliance

CMMC Configuration Management Requirements: The 9 Controls, Their Point Values, and What Assessors Check

By The Defense Compliance Report Editorial Team · Last reviewed July 2026 · Last verified July 10, 2026

This page provides educational research, not legal, contractual, or compliance advice. Confirm your scope and applicability with a CMMC Registered Practitioner (RP) or Registered Provider Organization (RPO), and, where legal or contractual interpretation is required, a qualified federal-contracts attorney.

The CMMC configuration management requirements are the nine security requirements in the Configuration Management (CM) family—CM.L2-3.4.1 through CM.L2-3.4.9—that CMMC Level 2 inherits from NIST Special Publication 800-171 Revision 2. They carry 44 assessment objectives and up to 33 scoring points. Six of the nine are worth five points each and cannot be carried on a plan of action, so if any one of those six is still NOT MET when your assessment results are finalized, there is no conditional pass. The assessment does not pass.

That last clause is the part most short “CM controls” summaries skip. They hand you nine bullet points as if they were nine equal boxes to tick. They are not. Under the CMMC Scoring Methodology, six of these nine requirements are worth five points each and are ineligible for a Plan of Action and Milestones (POA&M)—the mechanism that lets you defer a fix and still pass conditionally. The other three are worth one point each and may be deferrable. So the family is not a checklist of equal items; it is a tiered set in which two-thirds of the requirements, if unmet at finalization, end the assessment outright.

We built this page to put the whole family in one place—requirement text, objective counts, point values, conditional-status treatment, and evidence—straight from the primary sources: NIST SP 800-171 Rev. 2, the DoD CMMC Assessment Guide for Level 2, the CMMC Scoring Methodology at 32 CFR § 170.24, and the rest of 32 CFR Part 170. Every figure below is dated and sourced. Here is the fast version.

CMMC configuration management at a glance

What are the nine CMMC configuration management requirements?

CMMC Level 2 has nine configuration management requirements, numbered CM.L2-3.4.1 through CM.L2-3.4.9, drawn directly from the Configuration Management (CM) family of NIST SP 800-171 Rev. 2. Together they require a contractor to define an approved system state, control and analyze every change to it, strip away unnecessary functionality, govern what software can run, and monitor what users install. The DoD CMMC Assessment Guide for Level 2 breaks those nine requirements into 44 assessment objectives across the family.

One terminology note before the table, because it trips people up. You will see these called “controls,” “practices,” and “requirements” interchangeably. The formal term in the CMMC Final Rule and in NIST SP 800-171 is security requirements. Older CMMC 1.0 material used “practices” and control IDs like “CM.2.061.” Those IDs are dead. If a resource still numbers configuration management as “CM.2.061,” it predates the current model, and you should treat everything else on that page with corresponding skepticism.

The CMMC Configuration Management Control Matrix

*“POA&M-eligible” means the requirement’s point value permits it on a Conditional POA&M. Being a one-point requirement makes it a candidate only—it can sit on the POA&M solely if your overall score is at least 88, none of the six requirements the rule bars from POA&Ms is on it, and the other conditions in 32 CFR § 170.21(a)(2) are met. Sources: NIST SP 800-171 Rev. 2, family 3.4; DoD CMMC Assessment Guide—Level 2; NIST SP 800-171A (June 2018) for objective counts (incorporated by reference at 32 CFR § 170.2); 32 CFR § 170.24 for point values; 32 CFR § 170.21 for POA&M conditions.

Which CMMC levels require configuration management?

Configuration management does not exist at CMMC Level 1. It appears in full at Level 2—all nine requirements—and Level 3 adds three enhanced configuration management requirements on top of the Level 2 set. So if your contract requires Level 2 or Level 3, all nine CM requirements are in play; if it requires Level 1, none are.

This is the first place to stop guessing and check your contract. CMMC assigns a level based on the sensitivity of the information your systems touch, and the level is set by the contract clause, not by a checklist.

Level 3 is not “more of the same.” The three enhanced requirements it adds come from NIST SP 800-172, a separate standard for defending against advanced, persistent threats: an authoritative repository for approved software (3.4.1e), automated detection and remediation of unauthorized configurations (3.4.2e), and automated inventory (3.4.3e). Level 3 also requires you to already hold Final Level 2 (C3PAO) status for every information system in the Level 3 assessment scope.

A word on the standard itself, because search results are actively misleading here. CMMC Level 2 maps to NIST SP 800-171 Revision 2. NIST published Revision 3 in May 2024 and has since withdrawn Revision 2 from its current publication set. CMMC still uses the older editions because 32 CFR §§ 170.2 and 170.14 incorporate them by reference. For a CMMC Level 2 assessment, map your implementation and evidence to Revision 2. Track Revision 3, and watch for rulemaking, but don’t implement it for a current assessment.

How do the CM requirements affect your CMMC score and POA&M options?

Configuration management carries unusually high scoring consequences: six of the nine requirements are worth five points each and three are worth one point each, for up to 33 points of exposure on a 110-point Level 2 assessment. Only the three one-point requirements—CM.L2-3.4.3, 3.4.4, and 3.4.9—can even be candidates for a POA&M. The six five-point requirements must be MET when your results are finalized; there is no conditional pass with one of them still open.

How the score works.Your Level 2 score is recorded in the Supplier Performance Risk System (SPRS). Under the CMMC Scoring Methodology (32 CFR § 170.24), the score starts at 110—one point for each Level 2 requirement—and a weighted value is subtracted for each requirement scored NOT MET: 5 points for the most critical, 3 for some, and 1 for the rest. To be eligible for ConditionalLevel 2—a passing status with a POA&M attached—your score divided by the number of Level 2 requirements must be at least 0.8, which works out to a score of 88(32 CFR § 170.21(a)(2)(i)).

There are no three-point requirements in the CM family. That detail matters more than it looks, because of the POA&M rules.

The assessment-ender rule—this is the whole game.Under 32 CFR § 170.21, a POA&M for Conditional Level 2 may hold only one-point requirements (with one narrow, unrelated exception for a CUI-encryption requirement outside this family). Anything worth three or five points must be MET. Applied to configuration management:

• CM.L2-3.4.3, 3.4.4, and 3.4.9 (the one-pointers) can be POA&M candidates. If one is NOT MET, you may still reach Conditional status—provided your overall score is at least 88 and every other § 170.21 condition is met—and fix it later.
• CM.L2-3.4.1, 3.4.2, 3.4.5, 3.4.6, 3.4.7, and 3.4.8 (the five-pointers) cannot. If any one of those six is still NOT MET when results are finalized, no Conditional status is available. The assessment does not pass. You remediate and reassess.

The math that makes it concrete.Suppose you walk in with all nine CM requirements NOT MET and everything else perfect. That is a 33-point loss: 110 − 33 = 77. A 77 is below the 88 threshold, so you fail on the CM family alone. But you would fail before the arithmetic even ran, because one of those six five-pointers being open removes the conditional path outright.

One useful distinction: internal plan vs. assessment POA&M.Before an assessment, you can—and should—track every open gap in an internal remediation plan, no matter its point value. The restrictions above apply to the assessmentPOA&M used to obtain Conditional CMMC status, not to your own project tracker.

And don’t count on an “operational” workaround for a real gap. An Operational Plan of Action (OPA) is a legitimate tool: under § 170.24(b)(1)(ii), a genuine temporarydeficiency that is properly managed in an OPA—with deficiency reviews and demonstrated progress—is assessed MET. But the DoD’s CMMC FAQ draws the line clearly: once an assessor records a requirement as NOT MET, that gap belongs on a POA&M, not relabeled as an OPA. An OPA manages temporary risk on an otherwise-implemented control; it does not rescue a control you never implemented. If that control is a five-point CM requirement, Conditional status is off the table.

If you do land a POA&M on one of the three deferrable CM requirements, the clock is real: you have 180 daysfrom your Conditional CMMC Status Date to remediate and pass a closeout assessment, or the conditional status expires (32 CFR §§ 170.17, 170.21). The practical takeaway: prioritize the six five-pointers first, ruthlessly.

Can you fix a NOT MET requirement before a C3PAO assessment is finalized?

Sometimes—but narrowly. Under 32 CFR § 170.17(c)(2), a C3PAO may re-evaluate a NOT MET requirement during the assessment and for 10 business days after the active assessment period, but only if additional evidence is available, the new evidence doesn’t weaken any already-MET requirement, and the CMMC Assessment Findings Report hasn’t been delivered. It is a window to surface evidence you already have—not to build a control you don’t.

This is a real and underappreciated feature of a Level 2 certification assessment, and it is why “assessment-ender” on this page means a five-point gap that is stillNOT MET when results are finalized—not a gap the assessor flags mid-week. Read the conditions carefully:

• Additional evidence must exist.The rule contemplates producing evidence that was available but not reviewed during the assessment—a log you hadn’t pulled, an approval record in another system. It is not a grace period to go implement a missing control and come back.
• It cannot weaken a MET requirement.New evidence for one requirement can’t undercut another that already passed.
• The Findings Report must not have been delivered. Once that report is issued, scores are locked.

In practice, during the assessment week the C3PAO will tell you which requirements are short on evidence and ask you to produce it. After the active period, that 10-business-day window is your last chance to close the gap with existing proof before the report is finalized. Use it for what it is: an evidence-completeness safety net, not a remediation runway.

Is your CMMC score the same as your SPRS / NIST 800-171 self-assessment score?

Not exactly, and conflating them causes real confusion. CMMC status and scoring are governed by 32 CFR Part 170 and the DFARS 252.204-7021 clause. The older DFARS 252.204-7019 and -7020 clauses concern a separate “NIST SP 800-171 DoD Assessment” (Basic, Medium, or High) that also posts a score to SPRS. Both live in SPRS and use similar subtractive math, but they are distinct regimes—do not treat your legacy 800-171 self-assessment score as your CMMC assessment result.

The point for this page: when someone asks “what’s your SPRS score?” they may mean your legacy NIST 800-171 DoD Assessment score oryour CMMC assessment score. They are scored under different authorities. Your CMMC Level 2 score is the one produced under the CMMC Scoring Methodology at § 170.24 and recorded as a CMMC Status.

What evidence do CMMC assessors look for in configuration management?

CMMC does not define a single, universal evidence package for the CM family. Assessments use three methods—Examine, Interview, and Test—so a defensible evidence set connects approved documentation, the people who run each process, and a repeatable demonstration that the process and its technical controls actually work, mapped to every applicable assessment objective. The examples below are evidence-planning guidance drawn from the DoD guide’s potential methods and objects, not a guaranteed checklist; assessors select what fits, and no single artifact makes a requirement MET on its own.

Under § 170.24, a requirement is MET only when all applicable objectives are satisfied by evidence that is final and approved—working papers, drafts, and unapproved policies don’t count. Assessors are looking for all three legs of the triangle to line up, and to line up with the System Security Plan (SSP).

Looks implemented—still scored NOT MET

What does each CMMC configuration management requirement actually require?

Each of the nine requirements resolves a different piece of configuration control, and passing one does not satisfy the others. The deep dives below give you, for every requirement: what the rule says, its assessment objectives spelled out, what an assessor examines and tests, the failure that sinks it most often, and—just as important—what the requirement does not secretly require.

Read the one you’re stuck on. Each is written to stand alone.

3.4.6 vs 3.4.7 vs 3.4.8 vs 3.4.9: what’s the difference?

These four requirements overlap in theme but ask genuinely different questions. CM.L2-3.4.6 defines what capabilities a system should have. 3.4.7 restricts five specific categories of nonessential functionality. 3.4.8 controls what software is allowed to execute. 3.4.9 controls and monitors what users install. Treating them as one requirement is the fastest way to fail three of them.

A single example ties them together

Take a controlled engineering workstation:

• 3.4.6—You define that CAD, document access, an approved browser, endpoint security, and printing are the essential capabilities, and you configure the machine to provide only those.
• 3.4.7—You disable the unnecessary services, close the nonessential ports, block the disallowed protocols, and turn off optional features and programs across all five categories.
• 3.4.8—You enforce your chosen execution policy so only approved applications, scripts, and installers can run.
• 3.4.9—You restrict users from installing software and you monitor for attempts.

Same workstation, four requirements, four distinct forms of evidence. Build them in that order and each one feeds the next. Blur them together and an assessor will find the seams.

Does CMMC require DISA STIGs or CIS Benchmarks?

No. CMMC 3.4.2 requires you to establish and enforce security configuration settings, but it does not name DISA STIGs, CIS Benchmarks, or any single standard as mandatory. A benchmark is a strong, defensible way to prove your settings are “established”—but the requirement is about establishing and enforcing settings, not about which catalog you started from. A separate contract clause, prime, customer, or platform may impose a specific standard; CMMC 3.4.2 itself does not.

Here is the flexibility, plainly stated, and then the catch: because the rule does not choose the benchmark for you, you carry the burden of explaining what settings you selected, why they fit, how deviations are approved, how they’re enforced, and how drift is caught. Flexibility is not a free pass. It’s a documentation obligation.

So: pick a recognized benchmark if you can—it makes “established” easy to defend—tailor it to your environment, document what you changed and why, and prove enforcement. If a contract or prime requires a specific standard, that requirement is real and separate from CMMC; follow it. But don’t let anyone tell you CMMC mandates STIGs across the board. It doesn’t.

Which systems and assets must your CM evidence cover?

Your configuration management evidence has to cover every asset inside your CMMC Assessment Scope—and scope is defined by asset category, not by a vague sense of “our network.” Under 32 CFR § 170.19, Level 2 sorts assets into five categories, and the category determines how the nine CM requirements apply. Get scoping wrong and you either fail on assets you didn’t know were in scope, or you spend money hardening assets that never needed it.

Scope comes before everything. You cannot evaluate readiness against the CM family until you know where CUI lives, how it flows, and which systems are in the boundary. Here are the five categories, from the CMMC scoping framework at § 170.19.

The category that catches people is CRMA. Assets there are not exempt: they still have to appear in your inventory, network diagram, and SSP treatment, and their handling is assessed. And the boundary between “out of scope” and “in scope” is only as strong as the separation you can prove.

The scoping lever that actually changes your CM workload isn’t a trick of counting—it’s reducing the number and diversity of in-scope assets. A tightly scoped CUI enclave means fewer systems, fewer platforms, and fewer variations to baseline, harden, and monitor. Building the asset inventory is where scope gets formalized.

How do MSPs, MSSPs, CSPs, and other external service providers affect CM scope?

An MSP, MSSP, cloud service provider, or other External Service Provider (ESP) can pull itself into your assessment through the CUI it handles, the Security Protection Data it holds, or the security functions it performs for you. “Our MSP handles it” does not remove your obligation; it just means part of your evidence lives with someone else.

• If your MSP/MSSP handles CUI, provides security functions, or holds Security Protection Data, apply the ESP and asset-category rules, document the service in your SSP, a service description, and a customer responsibility matrix (CRM), and assess the shared responsibilities.
• If you use a cloud service to process, store, or transmit CUI, that CSP offering must be FedRAMP Moderate (or higher) Authorized—or meet the FedRAMP Moderate equivalency requirement (32 CFR § 170.17(c)(5)).
• Whatever the provider owns, you still have to be able to produce, or point to, the CM evidence for the assets in your scope.

The reason this matters for configuration management specifically: half of what fails an assessment is unclear ownership. If nobody can say whether you or your MSP maintains the baseline, enforces the settings, or monitors installations, that ambiguity becomes both a technical gap and an evidence gap. Write the split down before the assessor asks.

Where to start: implementing the nine in the right order

Do not implement the CM family in numerical order. Implement it in dependency order, because several requirements depend on the output of others: your inventory and baseline (3.4.1) feed your settings (3.4.2), which feed change control (3.4.3), and your definition of essential capability (3.4.6) is the foundation the functionality and execution requirements (3.4.7, 3.4.8) build on. Building out of order can force rework.

This is the Configuration-Control Chain in practice—a build sequence that keeps each requirement from tripping the next.

1. Confirm scope first.Know which assets are in the boundary (§ 170.19). Everything downstream is defined against this.
2. CM.L2-3.4.1—Inventory and baseline. You cannot secure, monitor, or control what you have not inventoried and defined an approved state for. This is the keystone.
3. CM.L2-3.4.6—Least functionality. Define what each system is forbefore you configure settings—it tells you what “secure” even means here.
4. CM.L2-3.4.2—Security settings. Establish and enforce settings against the baseline and the essential-capability definition.
5. CM.L2-3.4.7—Nonessential functions. Restrict the five categories, using the least-functionality definition as your guide.
6. CM.L2-3.4.8—Execution policy. Decide allow- or deny-by-exception and enforce it against your known software inventory.
7. CM.L2-3.4.9—User-installed software. Layer the policy, control, and monitoring on top.
8. CM.L2-3.4.5—Access to change. Lock down who can change the now-defined state, physically and logically.
9. CM.L2-3.4.3—Change control. Put the review-approve-log process around all of it.
10. CM.L2-3.4.4—Impact analysis. Add the pre-implementation security-impact step to the change process.

Steps 8–10 come last not because they are least important—3.4.5 is a five-pointer—but because a change-control process is only meaningful once there is a defined, approved state to protect. Build the state, then build the controls that guard it.

Are the CM requirements different for a self-assessment vs a C3PAO assessment?

No—the nine requirements, the 44 objectives, and the scoring criteria are identical whether you self-assess or a C3PAO certifies you. What changes is the assessor, the system your results are reported through, the formal re-evaluation you’re entitled to, the artifact-integrity mechanics, and the resulting status path. The bar is the same; the process and the paperwork around it differ.

This matters because contractors sometimes assume a self-assessment is a softer standard for configuration management. It is not. Your Intune baseline, your change log, and your execution policy have to satisfy the same objectives either way. The differences are procedural—but they’re real, and worth knowing before you choose or prepare for your path.

Who should own CMMC configuration management—and when do you need outside help?

Configuration management is not a one-person job, and unclear ownership causes as many failures as missing technology. Someone has to own the baseline and inventory, someone has to own settings and enforcement, someone has to own the change process, and someone has to own the evidence. On small teams these collapse into one or two people—which is fine, as long as it’s deliberate and documented, not accidental.

When outside help makes sense.If you have the technical depth, the hours, and the evidence discipline in-house, much of this family can be built internally—it is not exotic work. But if the deep dives made clear you’re short on any of those, that’s a category decision, not a personal failing:

• Missing process and evidence discipline → a Registered Provider Organization (RPO) or managed-compliance firm.
• Missing operational capacity (someone to actually run settings, monitoring, change control) → a Managed Security Service Provider (MSSP).
• Missing a compliant environment → a CUI enclave or a FedRAMP-authorized cloud platform.

The one rule you cannot break: keep readiness and assessment separate.The Cyber AB Code of Professional Conduct—which C3PAOs must comply with alongside the impartiality, conflict-of-interest, and ISO/IEC 17020 obligations in § 170.9—bars a firm from both preparing an organization for its assessment and participating in that assessment. Route implementation and remediation to an RPO, MSSP, or managed-compliance provider—never to the C3PAO you intend to hire for the certification.

When you do vet a C3PAO, use the Cyber AB Marketplace to confirm the firm’s current authorized or accredited C3PAO listing—that’s the authoritative check on whether it can legally certify you.

How do you keep configuration management compliant after the assessment?

Passing is a moment; compliance is a state. Configuration management is one of the most operationally demanding families to maintain, because your systems change constantly and every significant change can affect a CM requirement. After the assessment, your baseline, your settings, your change log, and your monitoring all have to keep running—and a significant change can pull something new into scope or knock an implemented control out of compliance.

The significant-change trap.A “significant change” isn’t only a big migration—it can be a change that makes a previously not-applicablerequirement suddenly applicable. Stand up a wireless network you didn’t have before, and wireless-related requirements that were N/A are now in play, with new configuration and evidence obligations. Your Affirming Official is responsible for judging whether a change is significant enough to warrant reassessment, and for the continuing accuracy of your affirmation.

OPA vs. Change Record vs. POA&M—which artifact when

The distinction the DoD FAQ draws: if a significant change introduces a temporary deficiency after you were compliant, an OPA may document the remediation plan. But if a change is identified duringan assessment and results in a requirement being scored NOT MET, that goes on a POA&M with the 180-day clock—and if it’s a five-point CM requirement, it can’t go on a POA&M at all.

A sustainable maintenance rhythm looks like this: before a change, run the 3.4.4 impact analysis and route it through 3.4.3 approval; during the change, update the baseline (3.4.1) and settings (3.4.2) so your approved state stays true; after the change, confirm monitoring (3.4.9) still sees what it should and log the whole thing. Do that consistently and your next assessment is a review of a living system, not an archaeology dig.

And mind the clock on your status itself: Final Level 2 status is current for up to three years, subject to annual affirmation; Conditional Level 2 status is current for no more than 180 days. Configuration management, done as ongoing operations rather than a pre-assessment sprint, is what keeps that status intact.

What we verified, and how

We hold this page to the standard we hold providers to. Here is the boundary between what the regulations say, what we calculated, and what is our editorial judgment.

Verified against primary sources (July 10, 2026):

• The nine CM requirements and their 44 objectives—NIST SP 800-171 Rev. 2 (family 3.4) and the DoD CMMC Assessment Guide for Level 2. Objective counts are our tally from the Assessment Guide.
• The point values—confirmed against the CMMC Scoring Methodology at 32 CFR § 170.24, which lists CM.L2-3.4.1, 3.4.2, 3.4.5, 3.4.6, 3.4.7, and 3.4.8 among the five-point requirements. These are CMMC point values, not “SPRS points.”
• The 88 / Conditional threshold, POA&M eligibility, and the 180-day closeout—32 CFR §§ 170.21 and 170.17.
• The 10-business-day re-evaluation window—32 CFR § 170.17(c)(2).
• Level mapping to NIST SP 800-171 Rev. 2, and the Rev. 3 / SP 800-172 status—32 CFR §§ 170.2, 170.14; NIST publication records.
• Asset categories and ESP/CSP treatment—32 CFR § 170.19 and § 170.17(c)(5).

Our calculations, labeled as such:the 33-point family exposure, the 313-point total possible deduction and −203 theoretical floor (summed from the § 170.24 values), and the 77-point all-CM-NOT-MET scenario.

Our editorial judgment, labeled as such:the “where it usually breaks down” commentary and the failure patterns in each deep dive. These reflect our reading of the assessment objectives and publicly reported assessment experience—not a measured, dated frequency dataset. Our editorial approach is documented in our Editorial Methodology and Standards, and we correct errors under our Corrections Policy.

Frequently asked questions about CMMC configuration management requirements

How many configuration management requirements are there in CMMC?

Nine at Level 2—CM.L2-3.4.1 through CM.L2-3.4.9—from NIST SP 800-171 Rev. 2. Level 3 adds three enhanced CM requirements from NIST SP 800-172. Level 1 has none.

Which CM requirements can’t go on a POA&M?

The six five-point requirements: CM.L2-3.4.1, 3.4.2, 3.4.5, 3.4.6, 3.4.7, and 3.4.8. If any one of them is still NOT MET when results are finalized, there is no Conditional pass. Only the three one-point requirements— 3.4.3, 3.4.4, 3.4.9—can be POA&M candidates, and only if your overall score is at least 88 and the other § 170.21 conditions are met.

Does CMMC Level 2 use NIST SP 800-171 Revision 2 or Revision 3?

Revision 2. NIST published Revision 3 in May 2024 and later withdrew Revision 2 from its current set, but CMMC still uses Revision 2 (and the June 2018 SP 800-171A objectives) because 32 CFR Part 170 incorporates them by reference. Build to Rev. 2 for your assessment.

Does CMMC require DISA STIGs or CIS Benchmarks?

No. CM.L2-3.4.2 requires you to establish and enforce security configuration settings; it does not mandate any specific benchmark. A benchmark is a defensible way to show settings are “established,” but you still have to tailor, approve, deploy, enforce, and evidence it. A separate contract or prime may require a specific standard.

Is a CMDB required for CM.L2-3.4.1?

No specific product is required. A controlled spreadsheet, repository, or platform export can support compliance if it’s complete, approved, maintained, and covers hardware, software, firmware, and documentation—though no single artifact guarantees a MET finding.

Does CM.L2-3.4.8 require application allowlisting?

No. It requires a defined, enforced execution policy and lets you choose deny-by-exception or permit-by-exception. Allowlisting is stronger, but denylisting done properly is compliant.

Can I fix a NOT MET requirement during a C3PAO assessment?

Within limits. Under § 170.17(c)(2), a NOT MET requirement can be re-evaluated during the assessment and for 10 business days after, if additional existing evidence is available, no MET requirement is weakened, and the Findings Report hasn’t been delivered. It’s a window to surface evidence you already have—not to build a missing control.

Is my SPRS score the same as my CMMC score?

Not necessarily. Your legacy NIST SP 800-171 DoD Assessment score (under DFARS 252.204-7019/-7020) and your CMMC assessment score both post to SPRS but are scored under different authorities. Your CMMC Level 2 score comes from the CMMC Scoring Methodology at § 170.24.

Can an Operational Plan of Action rescue a requirement the assessor marks NOT MET?

No. An OPA can support a MET finding for a genuine temporary deficiency on an implemented control (§ 170.24(b)(1)(ii)), but once an assessor records a requirement as NOT MET, that gap goes on a POA&M—and a five-point CM requirement can’t go on a POA&M at all.

Are the CM requirements different for a self-assessment?

No. The nine requirements, 44 objectives, and scoring are identical. What differs is the assessor, the reporting system (SPRS directly vs. eMASS), the 10-day re-evaluation, artifact hashing, and the status path.

How long does a CMMC status last?

Final Level 2 is current for up to three years, subject to annual affirmation. Conditional Level 2 is current for no more than 180 days, within which you must close your POA&M.

Where do the 44 objectives come from?

NIST SP 800-171A (June 2018), which 32 CFR § 170.2 incorporates by reference as the assessment objectives and methods for Level 2.

Does using an MSP remove my CM obligations?

No. If your MSP handles CUI, provides security functions, or holds Security Protection Data, it enters your scope as an External Service Provider; you document the split in your SSP, a service description, and a customer responsibility matrix, and you still have to produce or point to the evidence.