The Nine-Month Fix and the 180-Day POA&M Window
Northline Optics is a 240-employee manufacturer holding a $14M DoD prime contract for optical assemblies. Engineering drawings and acceptance test data marked CUI sit on a shared file server and on twelve engineering workstations. A contract modification arrives citing DFARS 252.204-7021 and specifying CMMC Level 2 with a C3PAO assessment; the contracting officer says the requirement applies at the next option exercise in seven months. Northline completed a NIST SP 800-171 self-assessment last quarter and posted 98 on the 110-point scale in SPRS. The 12 missing points are: multi-factor authentication not enforced on the engineering VPN (a 5-point requirement), two 3-point requirements on configuration baselines, and one 1-point requirement on physical access logs. The VPN replacement is funded but will not cut over for nine months. The CISO proposes booking a C3PAO assessment in five months and putting the MFA gap on a POA&M, arguing the score is comfortably above the threshold. The CFO wants to know whether they can simply affirm a Level 2 self-assessment instead and avoid the assessment fee.
1. Can Northline place the unmet multi-factor authentication requirement on a POA&M and still obtain Level 2 certification? Walk through the eligibility conditions and reach a conclusion.
Read the worked answer
The mechanism is conditional certification, and this case fails it on timing.
Under 32 CFR Part 170, a Level 2 C3PAO assessment may end in certification with a POA&M only if all of these hold:
- the assessment score meets the minimum floor in the rule (88 of 110 at the time of writing - confirm the current figure against the published rule before promising a client anything);
- every POA&M item can be closed inside the 180-day window the rule allows;
- no item sits on DoD's list of requirements that are never POA&M-eligible.
Northline fails the second condition outright. The VPN cutover is nine months out - roughly 270 days - so the MFA gap cannot be closed within 180 days of the assessment date. MFA (IA.L2-3.5.3) is also a 5-point, high-weight requirement, which makes it a weak and probably ineligible candidate on its own merits.
The CISO's argument misreads the threshold. The score floor is necessary, not sufficient, and it is measured on the posture you would hold after POA&M items are counted as unmet. A 98 that exists only because MFA is excluded from the count is not 98 for this purpose.
Verdict: no POA&M route to certification for this gap. Northline either implements MFA before the assessment date - for example MFA enforced at the identity provider in front of the VPN, with the full replacement following later - or it goes to the option exercise uncertified.
2. The CFO asks why Northline cannot just perform a Level 2 self-assessment and skip the C3PAO fee. Explain who decides and what would change.
Read the worked answer
The contractor does not choose this. The DoD requiring activity determines both the level and whether a self-assessment or a C3PAO certification assessment applies, based on the criticality of the CUI in that acquisition. That decision reaches the contractor through the solicitation and the DFARS 252.204-7021 clause. Once the clause specifies Level 2 with a C3PAO assessment, a self-assessment is not a cheaper substitute - it is noncompliance with a contract requirement.
Three things to tell the CFO:
- Assessments are not interchangeable. A self-assessment produces an SPRS score and a senior-official affirmation. It does not produce a CMMC certificate, and no certificate means the option cannot be exercised.
- Self-assessment would not solve the gap anyway. POA&Ms are not permitted on Level 1 or Level 2 self-assessments, so the 12-point gap would still block a truthful affirmation.
- The affirmation is a legal representation. A senior official who affirms implementation while knowing MFA is not enforced exposes the company to False Claims Act and 18 U.S.C. 1001 risk - a far larger number than an assessment fee.
The productive move is to engage the contracting officer early, confirm the requirement and date, and ask what flexibility exists on timing. Planning around an inaccurate affirmation is not a strategy.
3. Given the seven-month option exercise, what sequence would you recommend, and what must be true before the assessment is booked?
Read the worked answer
Sequence the work backwards from the option date, not from the assessment date.
- Weeks 1–8: implement MFA at the identity provider for the VPN and all administrative access; document the configuration, the enrolment report, and the exceptions list. Close the two 3-point configuration-baseline gaps in parallel, since they are process work rather than capital work.
- Weeks 8–14: update the system security plan and the evidence artefacts to match what is actually configured. Assessors test the described system; a stale SSP generates findings.
- Weeks 14–20: run a readiness assessment. Use an RPO or independent consultant - the same organization cannot later act as Northline's C3PAO for this system - to find what a C3PAO would find.
- Weeks 20–26: schedule the certification assessment with enough float that a re-test of a failed objective fits before the option exercise.
What must be true before booking: MFA is enforced and evidenced, not merely purchased; the remaining 1-point physical-log gap is closed or confirmed POA&M-eligible and closeable inside 180 days; and the SPRS entry has been refreshed so the score submitted reflects reality. Booking an assessment to hit a date, with the fix still nine months away, converts a scheduling problem into a failed assessment.