Defense Contractors Must Hit 88-Point CMMC Score and Fix Gaps in 180 Days
New CMMC rules mandate an 88-point minimum score and a strict 180-day window to resolve compliance gaps, changing how contractors manage their security status.
Key points
- CMMC Level 2 self-assessments now require a minimum score of 88 out of 110 points.
- Contractors must implement all requirements worth three or five points, plus specific one-point controls.
- Any unmet requirements trigger a 180-day clock to close gaps before contract eligibility expires.
Defense contractors must now achieve a minimum score of 88 on their CMMC Level 2 self-assessments to maintain contract eligibility. This new floor replaces the previous system, which allowed scores as low as negative 203. According to Huntress, these stricter rules mean organizations can no longer defer critical security requirements without risking disqualification.
In plain English
The Department of Defense has updated its compliance framework for defense suppliers. Under the old DFARS clauses, contractors could self-assess with any score. The new CMMC Level 2 rules, governed by DFARS 252.204-7021, set a hard minimum. You must score at least 88 points out of a possible 110.
This score is not arbitrary. The rules require you to implement all controls worth three or five points. You must also implement a specific list of one-point requirements. These mandatory controls alone yield 64 points. That leaves you with flexibility on only 24 of the remaining one-point controls to reach the 88-point threshold.
The background
Previously, contractors used DFARS 252.204-7019 and 252.204-7020 for self-assessments. Those clauses allowed a wide range of scores using the DoD Assessment Methodology. The new DFARS 252.204-7997 replaces those older clauses and aligns government assessments with the same CMMC scoring methodology.
Huntress notes that this shift creates a "rude awakening" for many contractors. They can no longer choose which requirements to skip. Missing a single non-negotiable requirement can void contract award eligibility or expose the organization to False Claims Act liability.
What changes now
The most immediate change is the 180-day clock. If a contractor submits a self-assessment with any unmet requirements, a 180-day period begins. This is known as the Plan of Action and Milestones (POA&M) closeout period.
Contractors must complete those remaining items and update their status in the Supplier Performance Risk System (SPRS) within 180 days. If they fail to do so, their Conditional Level 2 status expires. This expiration can silently disqualify a company from bids submitted during that timeframe.
Huntress reports that 32 of the 55 requirements they document are now non-negotiable. These include complex capabilities like ongoing system monitoring, security-event logging, threat detection, and incident handling. Organizations must configure these tools and maintain evidence that each requirement is met.
What to do and how to stay safe: CMMC
- Audit your current NIST 800-171 implementation to identify all three-point and five-point controls.
- Verify that you have implemented the specific list of mandatory one-point requirements.
- Calculate your current score against the 88-point minimum to determine your compliance gap.
- Establish a process to update SPRS within 180 days of any identified compliance shortfall.
General security guidance from the Vector Update newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is the minimum score for CMMC Level 2?
The minimum score is 88 points out of 110, which represents 80% of the requirements.
What happens if I have unmet requirements after my assessment?
You have 180 days to close out those items and update your status in SPRS, or your eligibility expires.
Which requirements are mandatory?
All requirements worth three or five points are mandatory, along with a specific list of one-point requirements.
