Most Teams Learn This at Assessment: 63 Controls Can’t Be Deferred

This report explains how 32 CFR 170.21 restricts POA&M eligibility for CMMC Level 2 assessments, identifies 63 of 110 controls that must be fully implemented prior to assessment (including six specific 1-point controls that will block certification such as CA.L2-3.12.4), describes scoring requirements (minimum 88/110 points and a 22-point margin, with a narrow encryption exception for SC.L2-3.13.11), and provides a four-step pre-assessment checklist and 180-day closeout timeline to help organizations map and remediate gaps before assessment day.