88-Point Score Now Mandatory: Defense Suppliers Face Strict Controls and 180-Day Fix Window

Defense contractors face stricter compliance thresholds under the new CMMC Level 2 framework, according to analysis by Huntress. The updated rules eliminate the flexibility previously available under legacy self-assessment protocols. Organizations can no longer choose which NIST SP 800-171 controls to defer during implementation. This shift exposes firms to significant contractual risks if they fail to meet the new non-negotiable standards.

How it unfolded

• Previous DFARS clauses allowed contractors to report any score, including negative values, using the DoD Assessment Methodology.
• The new DFARS 252.204-7997 clause replaces older provisions and mandates the use of the DOD CMMC scoring methodology.
• Federal regulations now set a hard floor for Conditional Level 2 status, requiring specific control implementations.

Who is affected

Contractors submitting CMMC Level 2 self-assessments must now adhere to mandates found in 32 CFR 170.21, according to Huntress. The regulation requires a self-assessment score of at least 80 percent of the 110 model requirements, which equals 88 points. Furthermore, organizations must implement every requirement valued at three or five points. A specific subset of one-point requirements is also mandatory. These non-negotiable controls account for 64 points, representing 85 percent of the total possible score.

This structure leaves contractors with limited flexibility. To reach the 88-point minimum, firms must select and implement 24 of the remaining 46 one-point requirements. The choice of which lower-value controls to address is the primary variable in achieving initial compliance. Failure to meet these specific thresholds voids contract award eligibility. It may also expose the organization to liability under the False Claims Act.

What happens next

The compliance timeline is accelerated for organizations with unmet requirements. Submitting a CMMC Level 2 self-assessment with any gaps starts a 180-day period to close out those items, according to Huntress. If the contractor fails to complete the remaining items and update their status in the Supplier Performance Risk System, the Conditional status expires. This expiration occurs regardless of the annual affirmation cycle.

Contractors must manage this clock carefully to avoid silent disqualification. An affirming official may attempt to submit an annual affirmation only to find the self-assessment has expired. This status change can disqualify the company from bids submitted during that timeframe. Huntress notes that 32 of the 55 requirements documented in their resources are now non-negotiable. Organizations must operationalize specialized capabilities, including ongoing system monitoring and threat detection, to meet these standards.

What to do and how to stay safe: CMMC

• Audit current NIST SP 800-171 implementations against the new 88-point minimum threshold.
• Verify that all three-point and five-point controls are fully implemented and documented.
• Monitor the 180-day POA&M clock for any unmet requirements to prevent status expiration.
• Update Supplier Performance Risk System records promptly after closing out compliance gaps.

Step-by-step guide: Mobile Device Security for Small Business: Control Without Cost

General security guidance from the Circuit Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is the minimum score for CMMC Level 2?

The minimum self-assessment score is 88 points, which is 80 percent of the 110 requirements in the model.

Are there specific controls that must be implemented?

Yes, all requirements worth three or five points are mandatory, along with a short list of one-point requirements.

What happens if requirements are not met immediately?

Unmet requirements start a 180-day clock; failure to close them out causes the Conditional status to expire.