CMMC POA&M 180-day closeout and SPRS tracking
Track each NOT MET requirement against the POA&M limits and the 180-day clock, and prepare what goes into SPRS. A person enters it, and your Affirming Official affirms it.
| Requirement | Check | POA&M? |
|---|---|---|
| SC.L2-3.13.11 | Not FIPS-validated | Allowed |
| Sample 1-pt item | Within 1-point cap | Allowed |
| IA.L2-3.5.3 | Over 1-point cap | Must be MET |
| PE.L2-3.10.3 | Excluded by 170.21 | Must be MET |
Sample data. Only SC.L2-3.13.11 may exceed the 1-point cap.
- Score
- 106 of 110
- POA&M floor
- 88 (0.8 of 110)
- CMMC Status Type
- CMMC L2 Conditional Self-Assessment
- Assessment Date
- Set when affirmed in SPRS
- CMMC Status Expiration Date
- 180 days after that
- Entered by
- A SPRS Cyber Vendor User
- Affirmed by
- Your Affirming Official
How it runs.
Conditional status expires if closeout is not posted within 180 days. Some requirements can never sit on a POA&M, and SPRS returns No CMMC Status when they do.
NOT MET findings
From your self-assessment, with point values and evidence.
Your dataPOA&M limits check
0.8 score floor, 1-point cap, excluded requirements, 180-day countdown.
AutomatedA person enters
A SPRS Cyber Vendor User enters. Your Affirming Official affirms.
A personCloseout record
Closeout results, dates and evidence kept for the next affirmation.
Automated
SPRS / PIEE / 32 CFR Part 170 / Ticketing system / Evidence store
The rules and limits.
- POA&M limits
- 32 CFR 170.21: the score must be at least 0.8 of the maximum, which SPRS shows as 88 to 109. No item above 1 point, except non-FIPS encryption at SC.L2-3.13.11.
- Never on a POA&M
- AC.L2-3.1.20, AC.L2-3.1.22, CA.L2-3.12.4, PE.L2-3.10.3, PE.L2-3.10.4 and PE.L2-3.10.5.
- The 180-day clock
- Closeout must be confirmed within 180 days of the Conditional CMMC Status Date, or the status expires. SPRS dates the record from affirmation and calculates the expiry.
- SPRS access
- Entry needs the SPRS Cyber Vendor User role through PIEE. SPRS publishes web entry guides, and we found no public API. So a person enters every result.
- Phase 2 status
- A July 13, 2026 Department of War CIO memo suspended the move to Phase 2. Level 2 (Self) can still be required. DFARS 7012 still applies. Checked November 9, 2026.
What a person does.
- A person with the SPRS Cyber Vendor User role enters results.
- Your Affirming Official, a senior company representative, affirms every record.
- Your team decides when a NOT MET item is actually MET.
- SPRS data is CUI, so the tracker runs inside your own boundary.
Where we stand: we have not shipped this. It uses the same pattern as our document extraction and review-queue work.
Common questions.
Can software submit or affirm in SPRS?+
We found no public API, and SPRS documents web entry by role. A person enters results. Affirmation stays with your Affirming Official, the senior company representative responsible under 32 CFR 170.22.
Does this make us compliant?+
No. It tracks items, dates and evidence. A POA&M is not a substitute for a completed requirement. Your team and Affirming Official answer for the result. This is not legal advice.
Did the Phase 2 suspension remove the 180-day rule?+
We found nothing changing it. 32 CFR 170.21 still sets 180 days, and DoD's Part 240 deviation repeats it. The suspension covers the Phase 2 transition. Check your solicitation and ask counsel.
Sources
- 32 CFR 170.21, POA&M
- 32 CFR 170.16, Level 2 self-assessment
- 32 CFR 170.22, affirmation
- 32 CFR 170.24, scoring
- SPRS user guide for awardees and contractors
- SPRS frequently asked questions
- SPRS user access
- DoD class deviation 2026-O0025 Rev 2, DFARS Part 240 (copy of signed memo)
General information, not legal, tax, or compliance advice. Rules change; confirm against the current source and your own advisers.
Bring us your version of this.
Intro calls are 30 minutes, free, and useful even if we never work together. We'll be honest about whether this is the right fit for your government contracting team.