Does the tracker check the subcontractor's answer?

No. It records what each subcontractor declares and reads the published rule against the dates. It does not look anything up in SPRS, verify a score or assess anyone; a finding is a date to chase or a question for the subcontracts lead.

Findings · finding 4 of 12

Subcontractor POA&M open past 180 days: what 32 CFR 170.21 says

A conditional status needs a score of at least 0.8 of 110, which is 88 (32 CFR 170.21(a)(2)(i)); the POA&M closes out within 180 days of the Conditional CMMC Status Date or the conditional status expires (170.21(b)); a POA&M is not permitted at Level 1 (170.21(a)(1)).

What the register reads

a date to chase

Ask whether the POA&M closeout assessment has been done and posted, and on what date.

The rule sentences behind it

4 cited

32 CFR 170.21(a)(2)(i)codified text, eCFR current to 24 Sep 2026

The assessment score divided by the total number of CMMC Level 2 security requirements is greater than or equal to 0.8;

Threshold read: conditional status only with a score of at least 0.8 of 110, which is 88. Source

32 CFR 170.21(b)codified text, eCFR current to 24 Sep 2026

The closing of a POA&M must be confirmed by a POA&M closeout assessment within 180-days of the Conditional CMMC Status Date. If the POA&M is not successfully closed out within the 180-day timeframe, the Conditional CMMC Status for the information system will expire.

Threshold read: POA&M closeout within 180 days of the Conditional CMMC Status Date. Source

DFARS 252.204-7021, "current" (1)(i)codified text, eCFR current to 24 Sep 2026; the same text is carried in Class Deviation 2026-O0025, effective 1 Feb 2026

Not older than 180 days for Conditional Level 2 (Self) assessments and Conditional Level 2 (certified third-party assessment organization (C3PAO)) assessments

Threshold read: Conditional Level 2: not older than 180 days. Source

32 CFR 170.21(a)(1)codified text, eCFR current to 24 Sep 2026

A POA&M is not permitted at any time for Level 1 self-assessments.

Threshold read: no POA&M at Level 1. Source

The clauses behind it

CMMC L2 CA.L2-3.12.2Plan of Action 3 points in the score

Develop and carry out plans of action that correct identified deficiencies and reduce or eliminate vulnerabilities.

What an assessor asks to see: Plan of action and milestones with owners and target dates; Evidence of progress and closure for completed items; Linkage from assessment findings to plan entries

Where subcontractors usually fall short: Plan maintained as a static list with no progress; Findings closed without evidence of correction; Deficiencies identified but never entered into the plan

Source: CMMC 2.0 Level 2 (NIST SP 800-171 Rev 2)

A line that raises it

invented

Pinecrest Fasteners | 7PF31 | 95 | 2026-02-10 | Level 2 (Self), conditional | 2026-02-10 | yes | no | yes | | 3 | 2026-10-30

See it in the specimen