Every CMMC score question comes down to one section of the rule, 32 CFR 170.24, and the POA&M section beside it, 170.21. Most explanations online start from the SPRS score instead, which uses the same point values for a different purpose, and the two get mixed. This article sets out the rule's scoring in the rule's own words: the three findings, the 110 points and how each requirement is weighted, the two requirements that earn partial credit, the line at 88 that decides whether a POA&M is allowed and the requirements that may never sit on one, Level 1 and Level 3, and then how the SPRS score relates to all of it. The CCP exam asks about each of these, under Domains 3, 4 and 5.
First, the three findings
Scoring starts with a finding for each requirement. The rule allows three. MET: "All applicable objectives for the security requirement are satisfied based on evidence." NOT MET: "One or more applicable objectives for the security requirement is not satisfied." NOT APPLICABLE: the requirement or objective "does not apply at the time of the CMMC assessment", and "an assessment objective assessed as N/A is equivalent to the same assessment objective being assessed as MET."
Two refinements matter in practice. Evidence "must be in final form and not draft", and the rule names "working papers, drafts, and unofficial or unapproved policies" as unacceptable. And two kinds of gap still count as MET: "Enduring exceptions when described, along with any mitigations, in the system security plan shall be assessed as MET", and "Temporary deficiencies that are appropriately addressed in operational plans of action" shall be assessed as MET too.
The Level 2 Assessment Guide adds the rule that trips candidates: "CMMC assessments are conducted and results are captured at the assessment objective level. One NOT MET assessment objective results in a failure of the entire security requirement." A requirement with six objectives, five satisfied, is NOT MET.
Level 2: 110 points, less the value of each NOT MET requirement
The rule's words: "The maximum score achievable for a Level 2 self-assessment or Level 2 certification assessment is equal to the total number of CMMC Level 2 security requirements." That is 110. "For each requirement NOT MET, the associated value of the security requirement is subtracted from the maximum score, which may result in a negative score."
Each requirement's value is 1, 3 or 5, and the rule ties the value to what a gap would do:
| Value | The rule's test | How many requirements |
|---|---|---|
| 5 points | "if not implemented, could lead to significant exploitation of the network, or exfiltration of CUI" | 42, of which 23 are basic and 19 derived |
| 3 points | "if not implemented, have a specific and confined effect on the security of the network and its data" | 14, 7 basic and 7 derived |
| 1 point | "have a limited or indirect effect on the security of the network and its data" | 52, all derived |
| 3 or 5 | the two adjustable requirements below | 2 |
The counts are from the rule's own lists in section 170.24, which name every 5-point and 3-point requirement; everything not named is 1 point. A pattern helps on the exam: every basic requirement is worth 5 or 3, never 1, and all 52 one-point requirements are derived.
The two partial credits
The rule says the methodology "is designed to credit partial implementation only in limited cases", and it names exactly two.
Multifactor authentication, IA.L2-3.5.3. "three (3) points are subtracted from the maximum score if MFA is implemented only for remote and privileged users. Five (5) points are subtracted from the maximum score if MFA is not implemented for any users."
FIPS-validated encryption, SC.L2-3.13.11. "If encryption is employed, but is not FIPS-validated, three (3) points are subtracted from the maximum score; if encryption is not employed; five (5) points are subtracted from the maximum score."
Everything else is all or nothing: the requirement is MET and costs nothing, or NOT MET and costs its full value.
The line at 88: when a POA&M is allowed
A NOT MET requirement does not end the assessment. It can go on a Plan of Action and Milestones, which gives the OSA a Conditional status and 180 days to fix it. But the rule allows that only under three conditions, all of which must hold:
- "The assessment score divided by the total number of CMMC Level 2 security requirements is greater than or equal to 0.8". With 110 requirements, that is a score of 88 or more.
- "None of the security requirements included in the POA&M have a point value of greater than 1", with one exception: "SC.L2–3.13.11 CUI Encryption may be included on a POA&M if encryption is employed but it is not FIPS-validated, which would result in a point value of 3".
- None of six named requirements is on the POA&M: AC.L2-3.1.20 External Connections, AC.L2-3.1.22 Control Public Information, CA.L2-3.12.4 System Security Plan, PE.L2-3.10.3 Escort Visitors, PE.L2-3.10.4 Physical Access Logs and PE.L2-3.10.5 Manage Physical Access.
So a 5-point requirement can never be deferred, a 3-point requirement only in the single encryption case, and six one-point requirements never. Put together, the most an OSA can leave open and still hold a Conditional status is 22 points' worth of eligible requirements, and only if every one of them is a 1-point requirement outside the excluded six, or the FIPS case plus nineteen of them.
Then the clock: "The closing of a POA&M must be confirmed by a POA&M closeout assessment within 180-days of the Conditional CMMC Status Date. If the POA&M is not successfully closed out within the 180-day timeframe, the Conditional CMMC Status for the information system will expire." For a self-assessment the OSA performs the closeout "in the same manner as the initial self-assessment"; for a certification assessment, an authorized or accredited C3PAO performs it.
Two more lines from the scoring section close common loopholes. "A POA&M addressing NOT MET security requirements is not a substitute for a completed requirement. Security requirements not implemented, whether described in a POA&M or not, is assessed as 'NOT MET.'" And the system security plan is a precondition rather than a requirement like the others: without an up-to-date SSP at the time of assessment, the finding is that "an assessment could not be completed due to incomplete information and noncompliance with 48 CFR 252.204–7012."
Level 1 and Level 3
Level 1 has no points. "All CMMC Level 1 security requirements must be fully implemented to be considered MET. No POA&M is permitted for CMMC Level 1, and self-assessment results are scored as MET or NOT MET in their entirety." One NOT MET requirement, and the Level 1 self-assessment is NOT MET.
Level 3 has points without weights. "CMMC Level 3 scoring does not utilize varying values like the scoring for CMMC Level 2. All CMMC Level 3 security requirements use a value of one (1) point for each security requirement." The maximum is the number of selected NIST SP 800-172 requirements, 24, and "The Level 3 certification assessment score is equal to the number of CMMC Level 3 security requirements that are assessed as MET." A Conditional Level 3 status needs 0.8 of the total, and seven named Level 3 requirements may never go on its POA&M.
How the SPRS score relates
The score contractors post in SPRS under the DFARS clauses is produced by the NIST SP 800-171 DoD Assessment Methodology, which the rule defines as "a standard methodology that enables a strategic assessment of a contractor's implementation of NIST SP 800–171 R2". The preamble to the CMMC rule explains the relationship in one sentence: "CMMC adopted the scoring as included in the NIST SP 800–171 DoD Assessment Methodology (DoDAM) used by the DCMA DIBCAC and referenced in DFARS clause 252.204–7020." The point values are the same.
What differs is what the number is for. A SPRS score is a contractor's own basic assessment, or a DCMA DIBCAC medium or high assessment, reported for the DFARS clauses; a CMMC score is the result of a CMMC assessment against the rule, which decides a CMMC Status. The rule connects the two only through standards acceptance, which lets a qualifying DCMA DIBCAC High Assessment count toward a Level 2 certification, and through the definition of that assessment, which starts from "A review of a contractor's Basic Assessment".
What to do next
Scoring is asked as arithmetic on the exam, and the arithmetic is quick once the rule's lists are familiar. The lessons on levels and assessment types and POA&M close-out work through the cases, and the course's practice questions include scored scenarios in Domains 3, 4 and 5. The first domain and the baseline are free with a free account.
By QualExam editorial. Written against the certifying body’s published documents, pinned by hash so a revised edition shows up as a change.