If an Organization Seeking Certification (OSC) has met most, but not all, security requirements, it may be eligible for a Conditional Certificate of CMMC Status. This is possible if the unmet requirements are documented on an existing and valid POA&M that complies with the regulations in 32 CFR §170.21. However, if an OSC has unmet security requirements and a valid POA&M is not attainable, the C3PAO will recommend that no certificate be issued.  The details of how POA&Ms work

For companies in the Defense Industrial Base (DIB), achieving CMMC Level 2 certification is more than a compliance milestone. Now more...

A common misconception among many at the lower end of the Defense Industrial Base (DIB) supply chain is the assumption that the...