CMMC Reassessment After Failure: Recertification, the 180-Day Clock, and What Happens Next
The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We are not affiliated with the Cyber AB, the Department of Defense, DCMA DIBCAC, NIST, or any U.S. government agency. This is educational research, not legal, contractual, or compliance advice.
You opened the assessment results expecting a pass. You got a list of NOT MET findings instead — and now a prime, a contracting officer, or your own boss is going to ask what it means for the contract. Here’s the part most teams get wrong in the first hour: CMMC reassessment after failureis not one path. It’s several, and the rule treats them in completely different ways.
The Defense Compliance Report is the independent trade publication and decision resource for CMMC and Defense Industrial Base compliance — explaining the CMMC Final Rule with primary-source citation on every claim and mapping a contractor’s level, CUI scope, assessment type, and timeline to the right provider category, so DIB contractors choose the right CMMC path before they spend six figures.
Which situation are you actually in? (start here)
Find the row that matches what you were told. Each one points to a different clock, a different assessor, and a different next move.
| If this is what happened | What it usually means | Your clock | Where to go next |
|---|---|---|---|
| You passed the score threshold but have open POA&M items | Conditional Level 2 — not a failure | 180 days to close out | The 180-day clock |
| Your assessment couldn't be completed (often a missing or incomplete SSP) | No Score | No conditional path until fixed | Conditional vs. No Status vs. No Score |
| Your score was below 88, or a high-value or "no-defer" control was NOT MET | No Status — no certificate issued | New full assessment after remediation | What a failed assessment actually means |
| You had Conditional status but missed the 180-day closeout | Conditional status expired | New full assessment; award ineligibility risk | Contract eligibility |
| You think a finding was simply wrong | Appeal path, not a remediation path | C3PAO appeal windows | Can you still fix it before it’s final? |
| Your environment changed materially after a clean result | Significant-change evaluation | Situation-specific | Edge cases |
Don’t panic-buy a provider yet. The single most valuable thing you can do in the first hour is classify your result precisely — everything downstream, including how much you’ll spend, depends on it.
The right provider depends on your situation — here’s the honest version
The category you need (a C3PAO, an RPO, an MSSP, a GRC platform, or a CUI enclave) depends on your required level, FCI vs. CUI handling, assessment type, cloud environment, and contract timeline. A general answer can’t resolve those for you.
Find My CMMC Path →No CUI, drawings, or sensitive contract details. Provider matching may generate referral or sponsorship compensation when disclosed; it does not change our category guidance.
One thing we’ll be straight about
We are an independent trade publication. We are not a C3PAO, an RPO, or a law firm. We can’t re-score your assessment, reinstate your status, or be the people who remediate your environment or re-assess it. We have no certificate to sell and no audit to win, so when we point you toward a category of help, it’s based on what your result actually requires. If you believe a specific finding was wrong, your move is the C3PAO’s appeals process and a qualified federal-contracts attorney — covered below.
CMMC reassessment after failure: what a failed assessment actually means
Failing a CMMC assessment rarely means one clean thing.You can receive a Conditional status with a 180-day fix-it window, “No Status” because a non-deferrable requirement was missed, “No Score” because the assessment couldn’t be completed, or an expired status after a missed closeout. Each outcome carries a different deadline, system of record, and contract consequence under 32 CFR Part 170. The first job after a bad result is to classify it precisely.
CMMC — the Cybersecurity Maturity Model Certification — is the Department of Defense program that verifies whether a contractor protects FCI (Federal Contract Information) and CUI (Controlled Unclassified Information). Most contractors who touch CUI land at Level 2, which maps to all 110 NIST SP 800-171 Revision 2 requirements. Level 2 assessments result in a formal status, not a pass/fail stamp — and that distinction is the whole thing.
The CMMC Failure Recovery Matrix
Built from 32 CFR 170.17, 170.21, 170.16, and 170.18. DCMA DIBCAC = Defense Contract Management Agency’s Defense Industrial Base Cybersecurity Assessment Center.
| What happened | Formal result | POA&M allowed? | Clock | Who runs the reassessment | Practical consequence |
|---|---|---|---|---|---|
| Level 1 self-assessment has any NOT MET requirement | No Final Level 1 | No — never | No 180-day path | You re-self-assess after all requirements are MET | You can't meet Level 1 until every safeguard is MET |
| Level 2 score is at least 88 and only eligible items remain | Conditional Level 2 (Self or C3PAO) | Yes — 1-point items only, plus the narrow SC.L2-3.13.11 encryption exception | 180 days | Self (Self path) or a C3PAO (C3PAO path) | Becomes Final if you close out in time |
| Level 2 SSP is missing or not complete at assessment | No Score | N/A until fixed | None until re-attempt | New assessment after the SSP is fixed | The assessment can't be completed at all |
| Level 2 score below 88, OR any requirement worth more than 1 point is NOT MET (other than the SC.L2-3.13.11 exception), OR a non-deferrable control is NOT MET | No Status — no certificate | No valid conditional path | None; you re-enter the queue | A C3PAO (or self, for the self path) | Remediate, then a full new assessment |
| Conditional Level 2 (C3PAO) closeout is finalized in eMASS with items still NOT MET | Conditional terminated | No second finalized eMASS closeout in that 180-day period | Window closes | A new full assessment is required | You re-enter the queue |
| Conditional Level 2 (Self) closeout isn't completed within 180 days | Conditional expired | No | 180-day clock ends | You remediate and re-self-assess | Award ineligibility risk if a current status was required |
| Level 3 (DIBCAC) assessment short of full implementation | Conditional Level 3 or no status | Narrowly (7 enhanced controls barred) | 180 days for conditional | DCMA DIBCAC runs the closeout | Level 3 requires Final Level 2 first; DIBCAC, not a C3PAO, decides |
| Clean Final status, but the environment changed materially | Possible reassessment | Not a POA&M issue by itself | Situation-specific | Your Affirming Official evaluates; reassessment may follow | A stale picture of your environment is a real status risk |
| You dispute the finding itself | Appeal path | Not a fix-it mechanism | C3PAO appeal windows | C3PAO first, then the Cyber AB | Appeals challenge handling/results, not your evidence gaps |
CMMC reassessment after failure vs. recertification: which path is yours?
Contractors often say “recertification after failure,” but CMMC uses more specific paths.If you hold Conditional status, your next event is a POA&M closeout. If you didn’t qualify, it’s remediation and a new assessment. A material change to your environment can trigger a reassessment, and a disputed finding goes to appeal — not remediation.
“Recertification” is searcher shorthand. In the rule, the path you’re actually on has a precise name, and naming it correctly is what keeps you from buying the wrong help:
- POA&M closeout — the follow-up assessment that re-checks only your open items, if you hold Conditional status.
- New assessment — a full re-do, if you didn’t qualify for Conditional status or your Conditional status lapsed.
- Reassessment after significant change — triggered when your environment changes in ways the original assessment didn’t cover.
- Annual affirmation — the senior-official attestation that keeps a current status valid between assessments. See our guide on CMMC annual affirmation requirements.
- Appeal — for disputing a finding or assessor conduct, not for fixing gaps.
Use the term that matches your result, because the clock, the cost, and the assessor are different for each one. For a side-by-side comparison of the self-assessment and C3PAO paths, see our guide on CMMC self-assessment vs. C3PAO.
Did you fail, or did you receive Conditional CMMC Status?
Conditional CMMC Status is not a failure. It means you met the score threshold and had only eligible POA&M items left, and you have 180 days to close them. “No Status” and “No Score” are different outcomes: No Status means you didn’t qualify for a certificate (a low score or a non-deferrable gap), and No Score means the assessment couldn’t be completed at all — including when the System Security Plan is marked NOT MET (32 CFR 170.21).
This is the single most important classification on the page, because it’s where money gets wasted. Teams hear “we have findings” and assume they failed, then go shopping for a full re-do they don’t need. Or they hear “Conditional” and treat it like a grace period, then burn the clock.
| Result | What it means in plain terms | Your immediate move |
|---|---|---|
| Conditional Level 2 (Self) | You met the threshold and have eligible POA&M items | Remediate and complete a POA&M closeout self-assessment, then post to SPRS, within 180 days |
| Conditional Level 2 (C3PAO) | You met the threshold and have eligible POA&M items | Remediate and pass a POA&M closeout certification assessment by a C3PAO within 180 days |
| No Status | Threshold not met, or a non-deferrable requirement is NOT MET | Remediate the blockers, then a new assessment — there is no shortcut closeout |
| No Score | The assessment couldn't be completed (commonly a missing/incomplete SSP) | Fix the SSP, scoping, and evidence package before any reassessment |
| Final Level 2 | All requirements MET — the clean result | Maintain it: annual affirmations and continuous compliance |
SPRS (Supplier Performance Risk System) is the DoD system where Level 2 self-assessment scores and status information are posted so contracting officers can verify them. Learn more on our SPRS score overview.
The “No Score” outcome deserves a flag: the rule is blunt. An organization must have a System Security Plan — control CA.L2-3.12.4— in place at assessment. Per 32 CFR Part 170, the absence of an up-to-date SSP results in a finding that “an assessment could not be completed due to incomplete information and noncompliance with 48 CFR 252.204-7012.” The SSP isn’t just another scored control. Without it, the assessor can’t finish, and your technical posture is irrelevant.
If you’re sorting out Conditional status and POA&M closeout specifically, see our companion guide on the Conditional CMMC Level 2 certificate and POA&M closeout rules.
The 180-day closeout clock: how much time you really have
For Level 2 and Level 3 Conditional status, you have 180 days from your Conditional CMMC Status Date to remediate every NOT MET item and pass a POA&M closeout assessment, which re-checks only the items on your POA&M (32 CFR 170.21). The clock starts the day your results post to SPRS or eMASS, it does not reset when you close items, and if it expires your Conditional status is gone and you re-enter the full-assessment queue. Treat 180 days as a hard ceiling, not a runway.
Three mechanics inside this rule matter more than the headline number.
Your start date is fixed — and so is your three-year clock. The Conditional CMMC Status Date is the date your results are submitted to SPRS or to eMASS (the Enterprise Mission Assurance Support Service, the government system C3PAOs and DIBCAC use to record certification results). The rule states plainly: that Conditional Status Date stays as your CMMC Status Date even after you reach Final — a new date is not set. So your three-year certification runs from the conditional date, not from the day you finish your POA&M. Spend all 180 days remediating, and you’ve burned six months of a three-year certificate before you ever reach “Final.”
The closeout only re-checks your open items. A POA&M closeout assessment, by definition in 32 CFR 170.21(b), assesses only the NOT MET requirements identified with a POA&M in the initial assessment. That’s a financial point: it’s why a closeout typically costs less than a fresh full assessment, and why you should resist the urge to casually expand scope or re-architect mid-remediation.
Who runs the closeout depends on your path. For a Level 2 self-assessment, you perform the closeout yourself. For a Level 2 certification, an authorized or accredited C3PAO must perform it. For Level 3, DCMA DIBCAC performs it. Per DoD’s CMMC FAQ, a C3PAO-path closeout can only be finalized in eMASS one time during the 180-day period — if requirements remain NOT MET when it’s finalized, the Conditional status terminates and you’re starting over. You get one clean shot. Don’t schedule it until your evidence is airtight.
A simple way to manage the window, working backward from Day 180:
| Checkpoint | Goal |
|---|---|
| Day 0 | Conditional Status Date — results posted; 180-day clock starts |
| Days 1–30 | Confirm every POA&M item, assign an owner, lock scope |
| Days 30–90 | Implement and operate the fixes (not just document intentions) |
| Days 90–120 | Internal validation — re-test each item against the assessment objectives |
| Days 120–150 | Schedule the closeout; confirm C3PAO, DIBCAC, or internal availability early — slots tighten as Phase 2 approaches |
| Days 150–180 | Freeze evidence, complete the closeout before expiration |
Can you still fix it before the result is final?
Sometimes the result isn’t locked yet. During the assessment and for up to 10 business days after the active assessment period — until the Assessment Findings Report is delivered — a NOT MET requirement can be re-evaluated if you produce additional evidence that doesn’t change other MET scores (32 CFR 170.17(c)(2)). After that, you can file a formal appeal with the same C3PAO, adjudicated by a quality reviewer who wasn’t on your assessment team.
This is the section that can save a contractor weeks. Before you accept a NOT MET as final, check whether either of these doors is still open.
The 10-business-day re-evaluation window
Under 32 CFR 170.17(c)(2), a requirement scored NOT MET can be re-evaluated during the assessment and for up to 10 business days after the active assessment period — but only if all three conditions hold: you have additional evidence that the requirement is actually MET, that evidence doesn’t change or weaken any requirement already scored MET, and the Assessment Findings Report has not yet been delivered. This is for the gap that was a documentation or evidence-presentation problem, not a “we hadn’t built it yet” problem. Move now — it closes the moment the report is delivered.
The C3PAO appeal
If you believe the assessment was mishandled or a finding was wrong, you file an appeal with the same C3PAO that ran your assessment. Under the Cyber AB CMMC Assessment Process and 32 CFR 170.9, that C3PAO must maintain a time-bound, published appeals process consistent with ISO/IEC 17020, and the appeal must be handled by a quality-assurance reviewer who was not on your assessment team. If the C3PAO’s decision doesn’t resolve it, the process can escalate to the Cyber AB. Confirm both windows with your C3PAO before you rely on them.
One jurisdiction line: the Cyber AB appeals process covers C3PAO (Level 2 certification) decisions only. It is not the appeal path for a DIBCAC assessment. If your dispute is over a Level 3 result, the Cyber AB will treat it as out of scope.
Be honest with yourself about what an appeal is for. It challenges assessor error or conduct — not “we disagree with the requirement,” not “we fixed it afterward,” and not “the control is expensive.” If your real problem is open gaps, your time is better spent remediating than appealing.
Why you can score 105 out of 110 and still fail
The total score doesn’t save you. To earn Conditional Level 2, your score must be at least 88 of 110 (the 0.8 threshold in 32 CFR 170.21), andevery deferred item must be worth only 1 point — no 3- or 5-point requirement may go on a POA&M, and six specific 1-point requirements can’t be deferred either. Miss one non-deferrable control — multifactor authentication is the classic example — and you can fail outright with an otherwise strong environment.
The 88-point floor. Conditional Level 2 requires your assessment score divided by 110 to be at least 0.8. That’s a minimum of 88 of 110. Get below 88 and there’s no conditional path — it’s No Status and a new assessment. For a full breakdown of how the score is calculated, see our guide on how to improve your SPRS score.
Only 1-point items can be deferred. Per 32 CFR 170.21(a)(2)(ii), nothing on your POA&M can be worth more than 1 point. Multifactor authentication (IA.L2-3.5.3) is a 5-point control — so if MFA isn’t fully in place, you can’t POA&M it, and a single missing high-value control can drop you below the line or block conditional status on its own.
There’s one narrow exception. The rule carves out SC.L2-3.13.11 (CUI Encryption): if you’re using encryption but it isn’t FIPS-validated, that item can go on a POA&M at a cost of 3 points instead of its usual 5. That’s the only exception to the 1-point rule.
The six specific 1-point controls that are barred from a POA&M no matter what (per 32 CFR 170.21(a)(2)(iii)(A)–(F)):
| Control | Requirement |
|---|---|
| AC.L2-3.1.20 | External Connections — verify and control/limit connections to external systems |
| AC.L2-3.1.22 | Control Public Information — control CUI posted on publicly accessible systems |
| CA.L2-3.12.4 | System Security Plan — develop, document, and periodically update the SSP |
| PE.L2-3.10.3 | Escort Visitors — escort visitors and monitor visitor activity |
| PE.L2-3.10.4 | Physical Access Logs — maintain audit logs of physical access |
| PE.L2-3.10.5 | Manage Physical Access — control and manage physical access devices |
These are program-integrity and CUI-boundary controls. Without an SSP, without control of your external connections and public-facing systems, without basic physical protection of CUI — your compliance picture isn’t defensible regardless of how few points they’re “worth.” The POA&M is a tool for closing a short tail of minor gaps — not a strategy for deferring real work.
The gap that sinks otherwise-capable teams is usually evidence quality, not missing technology — a control that’s genuinely running but can’t be proven still scores NOT MET.
What a CMMC reassessment actually costs
Your reassessment cost is driven less by averages than by which state you’re in. A POA&M closeout re-checks only your open items, so it typically costs less than a full assessment; a No Status result or an expired Conditional status means paying for a full Level 2 assessment again. For scale, DoD’s Final Rule estimates a small contractor’s Level 2 C3PAO assessment plus initial affirmation at about $101,752, or roughly $104,670over three years. Knowing your state is worth more than any cost average, because it determines whether you’re buying a partial closeout or a full do-over.
What DoD estimated (primary source). In the 32 CFR Part 170 Final Rule analysis, DoD puts a small contractor’s Level 2 C3PAO assessment plus initial affirmation at about $101,752 — including a roughly $31,234 C3PAO assessment-engagement line item — and about $104,670 over the full three-year cycle. (Other-than-small entities are modeled with a larger C3PAO engagement line, around $52,056.) DoD’s commonly cited range across company sizes is $105,000–$118,000. Important caveat: those figures cover assessment, affirmation, and engagement activities only — they deliberately exclude readiness and remediation.
What the market charges (industry estimates). Based on C3PAO and managed-service pricing reviewed in 2026, the C3PAO assessment fee alone commonly runs $30,000–$75,000, varying with scope, company size, and region. Remediation commonly runs $10,000 to $150,000 or more depending on starting maturity. Treat these as planning ranges and confirm a fixed scope in writing. We keep a running breakdown on our CMMC Level 2 cost page.
| Your situation | What gets re-checked | DoD estimate reference | Market signal (industry estimate) | What to confirm before you pay |
|---|---|---|---|---|
| Conditional → POA&M closeout | Only your open POA&M items | A closeout is narrower than a full assessment | A reduced C3PAO engagement vs. a full assessment | Whether the statement of work includes the closeout, travel, and a named Lead CCA |
| No Status / expired Conditional | All 110 requirements (a full new assessment) | ~$101,752 assessment + initial affirmation (small entity); ~$104,670 over 3 yrs | C3PAO assessment fee commonly ~$30,000–$75,000+ | The full assessment fee again, plus your remediation cost |
| Any path | Remediation to close the gaps | Excluded from DoD's assessment estimate | Commonly ~$10,000–$150,000+ by starting maturity | Whether a gap assessment is included before the re-test |
Cost allowability (whether CMMC costs are reimbursable): the DFARS CMMC rule doesn’t resolve this; it points to FAR 31.201-2, meaning your contracting officer and accounting team determine it case by case. Don’t assume you can pass these costs through.
Who performs your closeout or reassessment — and who legally can’t be the same firm
The party that re-assesses you depends on level and path: a Level 2 self-assessment closeout is performed by your own organization, a Level 2 certification closeout by an authorized or accredited C3PAO, and a Level 3 closeout by DCMA DIBCAC (32 CFR 170.21). A readiness or remediation firm can help you fix the gaps, but it cannot also be the C3PAO that assesses you. That separation is a rule, not a preference.
After a failure, your first hire is almost always a readiness/remediationcategory — an RPO (Registered Provider Organization) or RP (Registered Practitioner), a CMMC-focused MSSP or MSP, or a GRC platform and CUI enclave. The C3PAO comes back only to re-test. Routing a just-failed remediation lead to a C3PAO “to fix it and then assess it” is exactly the conflict the rule is built to prevent.
Your assessor is deliberately the wrong firm to remediate. Under the Cyber AB CMMC Assessment Process, the assessment results briefing isn’t allowed to prescribe how to fix your findings, and 32 CFR 170.9 incorporates the Cyber AB’s conflict-of-interest rules — the firm that consulted to prepare your organization can’t be the C3PAO that assesses you. That wall is what makes the certificate mean something, and it’s why “readiness” and “assessment” show up as separate categories in any honest provider map.
A different C3PAO can do your closeout. You’re not locked to the C3PAO that issued your Conditional certificate. Per the CAP, an organization with a Conditional Level 2 certificate may retain a different authorized or accredited C3PAO to perform the POA&M closeout, and that closeout C3PAO takes responsibility for the Final status determination after its own conflict-of-interest review. Useful if scheduling or fit pushed you to look elsewhere.
What to do in the first 24 hours — and the 180-day recovery plan
The first 24 hours after a failed or conditional result are for classification, preservation, and deadline control— not panic-buying another provider. Identify your formal result, preserve the full assessment record, map each NOT MET item to POA&M eligibility, calculate your 180-day clock if Conditional status applies, and keep remediation work separate from formal assessment work.
Your first-24-hours checklist:
- Save everything: the results briefing, the POA&M items, your Conditional Status Date, the assessed scope, CAGE codes, the CMMC unique identifier, and your evidence artifacts and hashes. (The rule requires you to retain hashed assessment artifacts for six years from the CMMC Status Date — start that discipline now.)
- Name your result precisely: Conditional, No Status, No Score, expired, or a result you intend to appeal.
- Pin the root cause: score threshold, a non-deferrable control, a missing SSP, evidence quality, technical implementation, scope, or a contract deadline.
- Calculate your 180-day deadline if you’re Conditional.
- Don’t ask your C3PAO to prescribe the fix in a way that compromises its independence.
- Decide whether you need counsel before you communicate status to a prime or contracting officer.
- Build a remediation owner list — one named person per open item.
| Window | Goal | What “done” looks like |
|---|---|---|
| Day 0–1 | Classify the result | Status bucket, deadline, and owners are confirmed |
| Day 1–7 | Build the recovery map | NOT MET list, POA&M eligibility per item, scope confirmed and frozen |
| Day 7–30 | Clear the hard blockers | SSP complete; any non-deferrable control fully implemented |
| Day 30–90 | Implement and operate | Controls actually running and generating evidence, not just documented |
| Day 90–120 | Validate internally | Every previously-failed item re-tested against the assessment objectives |
| Day 120–150 | Schedule the closeout | C3PAO, DIBCAC, or self-closeout process confirmed and booked |
| Day 150–180 | Close out | Evidence frozen; closeout completed before expiration |
A word on timing: 32 CFR Part 170 took effect December 16, 2024, and DFARS 252.204-7021 became effective November 10, 2025, opening Phase 1 (Nov. 10, 2025 through Nov. 9, 2026), with Phase 2 enforcement beginning November 10, 2026.DoD generally leads with the right self-assessment requirement in Phase 1 — but it can require a Level 2 C3PAO assessment at its discretion even now, and if a solicitation or contract requires a current CMMC status, a stalled or failed assessment can already cost you an award, option, or extension.
Capacity is finite: as of the March 2026 Cyber AB Town Hall, the ecosystem had roughly 103 authorized C3PAOs and about 759 certified assessors, with only about 1,000 organizations certifiedagainst a Defense Industrial Base where at least 80,000 are expected to need Level 2. The honest read isn’t that the assessor pool will sink you — it’s that demand will spike as Phase 2 approaches and your own readiness is the real bottleneck. Book early, but fix the root cause first.
What changes by level: Level 1, Level 2 Self, Level 2 C3PAO, and Level 3
Level and assessment type change almost everything about recovery: whether a POA&M is even allowed, who performs the closeout, where results are posted, and what contract consequence follows. Level 1 is an annual self-assessment with no POA&M permitted; Level 2 is self-assessed or C3PAO-assessed depending on the contract; Level 3 requires a Final Level 2 first and is assessed by DCMA DIBCAC, not a C3PAO (32 CFR 170.16–170.18).
| Path | Requirement set | Who assesses | POA&M? | Cycle |
|---|---|---|---|---|
| Level 1 (Self) | FAR 52.204-21 basic safeguarding (15 requirements) | Your organization | No | Annual self-assessment |
| Level 2 (Self) | NIST SP 800-171 Rev. 2 — 110 requirements | Your organization | Limited (1-point items only) | Triennial self-assessment + annual affirmation |
| Level 2 (C3PAO) | NIST SP 800-171 Rev. 2 — 110 requirements | Authorized/accredited C3PAO | Limited (1-point items only) | Triennial certification + annual affirmation |
| Level 3 (DIBCAC) | Selected NIST SP 800-172 requirements, plus Level 2 | DCMA DIBCAC | Limited (7 enhanced controls barred) | Triennial assessment + annual affirmation |
Level 1 has no safety net. Every Level 1 requirement must be MET; POA&Ms are not permitted at any time. There’s no conditional status to fall back on — you fix the gap and re-self-assess. CMMC Level 2 maps to NIST SP 800-171 Revision 2, not Revision 3, unless and until DoD amends the rule.
Level 3 raises the bar and changes the referee. Level 3 layers selected enhanced requirements from NIST SP 800-172 on top of Level 2, and a Final Level 2 (C3PAO) is a prerequisite before DIBCAC will even schedule a Level 3 assessment — a Conditional Level 2 doesn’t qualify. For a Conditional Level 3, the rule bars seven specific enhanced requirements from any POA&M: IR.L3-3.6.1e (Security Operations Center), IR.L3-3.6.2e (Cyber Incident Response Team), RA.L3-3.11.1e (Threat-Informed Risk Assessment), RA.L3-3.11.4e (Security Solution Rationale), RA.L3-3.11.6e (Supply Chain Risk Response), RA.L3-3.11.7e (Supply Chain Risk Plan), and SI.L3-3.14.3e (Specialized Asset Security). If you’re at Level 3, those have to be fully implemented going in.
What happens to your contract if Conditional status expires?
If you don’t successfully close out within 180 days, your Conditional status expires. Under 32 CFR 170.17, if that happens during contract performance, standard contractual remedies may apply, and you become ineligible for additional awards requiring that level (or higher) until you achieve a new CMMC status. DFARS 252.204-7021 separately requires you to have and maintain the current CMMC status for systems that process, store, or transmit FCI or CUI. This is the point where a compliance problem becomes a contract problem.
An expired status does not automatically terminate your contract by itself. What the rule says is that standard contractual remedies may apply and that you become ineligible for additional awards at that level until you achieve a new status. The practical significance depends on whether you’re mid-performance, whether the clause is in your contract, and whether the affected systems actually handle FCI or CUI for that work. Those are determinations for your contracting officer and counsel, not a website. For a deeper look at non-compliance consequences, see our guide on CMMC non-compliance penalties.
A short decision tree to size your exposure:
- Are you in the proposal stage, or already under contract?
- Is the CMMC clause (DFARS 252.204-7021) actually in the contract?
- Do the affected systems process, store, or transmit FCI or CUI for that work?
- Is the issue an expired Conditional status, a stale affirmation, a failed closeout, or a changed environment?
- Has a prime flowed down a requirement to you as a subcontractor?
- Has the contracting officer asked for proof of status?
Edge cases: self-assessment, Level 3, significant change, and subcontractors
A few common situations shift the recovery path. A failed Level 2 self-assessment is fixed by you (remediate, re-self-assess, re-post to SPRS); a significant change to your environment can trigger a reassessment even after a clean result; DFARS 252.204-7021 allows DoD to require a rare reassessment despite a current status if there are indications of cybersecurity or compliance issues; and a subcontractor’s failed status can affect a prime’s ability to use it on CUI work.
The significant-change reassessment. Per DoD’s CMMC FAQ, a reassessment may be required when the environment changes in ways the original assessment didn’t cover — for example, when objectives that were previously Not Applicable become applicable, or when systems and tools that weren’t assessed enter your environment. Your status reflects the environment that was assessed. Change the environment materially and the status may no longer reflect reality, which is a risk your Affirming Official has to evaluate.
DoD’s rare reassessment right. DFARS 252.204-7021 says assessments generally won’t duplicate a comparable assessment, except in rare cases where a reassessment is necessary — such as indications of cybersecurity or compliance issues. It’s not common, but it’s in the clause, and it’s a reason to keep your posture defensible between formal assessments, not just on assessment day.
Subcontractors and flow-down. If you’re a sub and your status lapses, the consequence often lands on the prime: the prime has to ensure the work is performed by suppliers that hold the required status for systems touching FCI or CUI. We won’t overstate the mechanics — exactly how flow-down applies to your situation is a contract question — but the takeaway is that a sub’s failure is rarely a private problem. Loop in the prime and, if the stakes are material, counsel.
How SPRS, eMASS, the CMMC UID, and affirmations fit into recovery
Recovery isn’t finished until the correct result is reflected in the correct system of record and backed by the required affirmation. Level 2 self-assessment results live in SPRS; C3PAO and DIBCAC certification results are handled in CMMC eMASS and transmitted to SPRS; and DFARS 252.204-7021 requires a current status plus annual affirmations for covered systems.
For a Level 2 self-assessment, your SPRS entry includes the CMMC Level, the CMMC Status Date, the assessment scope, your CAGE code(s), the overall score, and POA&M usage and compliance status. For a Level 2 C3PAO assessment, the C3PAO submits results into CMMC eMASS — including your SSP name, date, and version, the result for each requirement, POA&M usage, and artifact-hashing data — and eMASS transmits to SPRS.
One detail to watch: any systems notrepresented by the CMMC unique identifier (UID) you provide for a solicitation can be treated as non-compliant for processing, storing, or transmitting FCI or CUI during performance. And a final status isn’t self-sustaining — it has to be paired with the senior official’s affirmation after the assessment, after any closeout, and annually thereafter. If your environment has drifted to the point where you can’t honestly affirm, that’s a counsel conversation before you attest, not after.
Frequently asked questions
What happens if you fail a CMMC Level 2 assessment?
If you met the 88-point threshold and only POA&M-eligible items remain, you receive Conditional Level 2 and have 180 days to close out the POA&M (32 CFR 170.21). If you didn't qualify — a low score, a requirement worth more than 1 point NOT MET (outside the SC.L2-3.13.11 encryption exception), or one of six non-deferrable controls NOT MET — no certificate is issued, and you remediate before a new full assessment.
Do you have to start over if you fail CMMC?
Sometimes. If you didn't qualify for Conditional status, your Conditional status expired, or a finalized closeout still had NOT MET items, you remediate and undergo a new full assessment of all 110 requirements. If you hold Conditional status and are within the 180-day window, you only need a closeout that re-checks your open items, not a full do-over.
Can you appeal a failed CMMC assessment?
Yes. For Level 2 C3PAO assessments, you file with the same C3PAO that assessed you, and a quality reviewer who wasn't on your assessment team adjudicates it; it can escalate to the Cyber AB. Appeals address genuine errors or assessor misconduct, not simple disagreement, and the filing and elevation windows are set by the C3PAO's published process and the Cyber AB Appeals Process. The Cyber AB appeals process does not cover DIBCAC (Level 3) assessments.
How long do you have to fix a CMMC POA&M?
180 days from your Conditional CMMC Status Date — the date results posted to SPRS or eMASS. The clock doesn't reset when you close items, and if it expires your Conditional status expires with it (32 CFR 170.21; 170.17).
What's the difference between Conditional and Final CMMC status?
Conditional Level 2 means you passed the score threshold but have open POA&M items; Final Level 2 means all requirements are MET, either initially or after a successful closeout. Your three-year clock runs from the original Conditional Status Date, which doesn't change when you reach Final.
Can I just put the failed controls on a POA&M?
Only if you scored at least 88 and every deferred item is worth 1 point — no requirement worth more than 1 point, and none of six specific 1-point controls (AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4, PE.L2-3.10.5), may be deferred. The only exception is SC.L2-3.13.11 (CUI Encryption) when encryption exists but isn't FIPS-validated (32 CFR 170.21).
Is the Level 2 passing score 88?
For Conditional Level 2, your score divided by 110 must be at least 0.8, which works out to a minimum of 88. But score alone isn't enough — a missing SSP or a non-deferrable control NOT MET can block Conditional status even when your number looks close (32 CFR 170.21).
How much does a CMMC reassessment cost?
A POA&M closeout re-checks only your open items and usually costs less than a full assessment, while a No Status result or an expired Conditional status means paying for a full Level 2 assessment again. DoD's Final Rule estimates a small entity's Level 2 C3PAO assessment plus initial affirmation near $101,752 (about $104,670 over three years); market quotes for the assessment fee alone commonly run $30,000–$75,000, with remediation a larger variable.
Can the company that fixed our gaps also do our reassessment?
No. Your remediation firm can't be the C3PAO that assesses you; the assessment must be independent of the work that prepared you (Cyber AB CMMC Assessment Process; 32 CFR 170.9). A different C3PAO than the one that issued your Conditional certificate may, however, perform your closeout.
Is a failed CMMC assessment public?
Per DoD's CMMC FAQ, the public won't have access to a list of companies' self-assessments or certificates; you can view your own scores and status in SPRS, and you can share verification with a prime. A failed result isn't a public scarlet letter — it limits award eligibility for contracts requiring that status until you achieve a new status.
Do we need a lawyer after failing CMMC?
You may, if the result affects a live contract, a proposal, a prime flow-down, a representation to the government, termination risk, or an appeal. This page is educational research, not legal advice — confirm scope and applicability with a CMMC Registered Practitioner (RP/RPO) or a qualified federal-contracts attorney.
Sources we read for this guide
- 32 CFR Part 170 — CMMC Program rule, including §170.16, §170.17, §170.18, §170.21, and §170.24. Underlying rule: 89 FR 83214 (Oct. 15, 2024).
- DFARS 252.204-7021, 252.204-7012, and 252.204-7020 (Acquisition.gov).
- NIST SP 800-171 Revision 2 and NIST SP 800-171A (June 2018), incorporated by reference in 32 CFR Part 170; NIST SP 800-172 (NIST CSRC).
- Cyber AB CMMC Assessment Process (CAP) and Cyber AB Appeals Process.
- DoD CIO CMMC Frequently Asked Questions; DoD CIO CMMC Assessment Guide — Level 2 and Scoping Guide — Level 2.
- Supplier Performance Risk System (SPRS) documentation.
- Capacity figures: Cyber AB Town Hall reporting (March 2026).
Disclosure: The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We may receive compensation for qualified introductions, sponsorships, or partner referrals when disclosed. Compensation does not control our regulatory analysis, provider-category recommendations, or Cyber AB status verification. This article is educational research, not legal, contractual, or compliance advice. The contract clause and your CUI handling set your required level, not a checklist. Confirm scope and applicability with a CMMC Registered Practitioner (RP/RPO) or a qualified federal-contracts attorney. See our editorial standards and corrections policy.
Need help deciding what type of CMMC provider you need?
Find My CMMC Path
Tell us your level, scope, and timeline. We’ll match you with source-checked CMMC provider options.
Do not submit CUI, drawings, export-controlled technical data, contract-sensitive details, system diagrams, vulnerability details, or customer-specific information.
Find My CMMC Path
The right provider category — a C3PAO, an RPO, an MSSP, a GRC platform, or a CUI enclave — depends on your required CMMC level, FCI vs CUI handling, assessment type, IT/cloud environment, and contract timeline. Use The Defense Compliance Report's Find My CMMC Path tool to map your situation to the right provider category before you request quotes. Educational triage only: free · 2-minute assessment · no obligation · do not submit CUI, drawings, or sensitive contract details.
Find My CMMC Path →