CMMC Conditional Status - Contracting Without Compliance

This report explains how contractors and subcontractors can use a CMMC Level 2 or 3 Conditional Status to handle Controlled Unclassified Information (CUI) while they remediate unmet controls. It details required artifacts (System Security Plan and Plan of Action and Milestones), mandatory controls that must be met, minimum assessment score thresholds (80%), scoring and point values for Level 2 and 3, and the requirement to close out remaining findings and be re-assessed within 180 days to obtain a Final Status.