Key points
- Contractors must achieve at least 88 points on their CMMC Level 2 self-assessment.
- All requirements worth three or five points are mandatory and cannot be deferred.
- Unmet controls trigger a 180-day clock; failure to close gaps expires conditional status.
Defense contractors facing CMMC Level 2 compliance now confront a rigid scoring floor that eliminates previous flexibility. According to analysis by Huntress, the new framework requires a minimum score of 88 points out of a possible 110. This threshold replaces older self-assessment methods that allowed contractors to report any score, including negative values, under previous DFARS clauses. Missing this baseline can void contract eligibility or expose firms to False Claims Act penalties.
In plain English
The new rules change how contractors prove their security posture to the Department of Defense. Previously, companies could submit self-assessments with low scores using the DoD Assessment Methodology. Now, 32 CFR 170.21 sets a hard requirement: you must implement all controls worth three or five points. You must also implement a specific list of one-point controls. These non-negotiable items alone account for 64 points. Contractors have limited flexibility, needing to select only 24 additional one-point controls to reach the 88-point minimum.
The background
Legacy self-assessments under DFARS 252.204-7019 and 252.204-7020 allowed wide variance in reported compliance levels. The new DFARS 252.204-7997 clause replaces those older provisions and mandates the use of the DoD CMMC scoring methodology. This shift aligns government DIBCAC assessments with the same scoring system used for self-assessments. The change removes the ability for contractors to arbitrarily defer requirements during their NIST 800-171 implementation, creating a more uniform standard for all defense suppliers.
What changes now
Submitting a self-assessment with any unmet requirements starts a 180-day countdown. Contractors must close out those remaining items and update their status in the Supplier Performance Risk System (SPRS) within that window. If they fail to do so, their Conditional Level 2 status expires. This expiration happens silently, potentially disqualifying the company from bids submitted during that period. Affirming officials may discover the expired status only when attempting to submit annual affirmations, causing unexpected compliance failures.
What to do and how to stay safe: CMMC
- Review your current self-assessment against the 88-point minimum and ensure all three- and five-point controls are fully implemented.
- Map your remaining one-point controls to identify which 24 you will activate to meet the score threshold.
- Establish a process to track the 180-day clock for any open Plan of Action and Milestones (POA&M) items.
- Update your SPRS status immediately after closing any gaps to prevent silent expiration of your conditional compliance status.
Step-by-step guide: How Software Updates Work: The Hidden Verification Steps
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the minimum score required for CMMC Level 2?
The minimum score is 88 points, which represents 80% of the 110 requirements in the model.
Can I defer three-point or five-point requirements?
No, all requirements worth three or five points must be implemented as they are non-negotiable.
What happens if I do not fix gaps within 180 days?
Your Conditional Level 2 status expires, potentially disqualifying you from contract awards.
