CMMC readiness, end to end
Theme
Phase 5 drill-down: mark objectives and recompute

Marking and scoring

How a consultant's MET or NOT MET on each objective rolls up to requirements, a score, a plan of action for each eligible gap, and a record of how the score moved, recomputed on its own shortly after the last mark.

110
the Level 2 maximum: one point of headroom per requirement
88
the lowest score that can reach Conditional status with a POA&M
6
named requirements that can never be deferred to a POA&M
~90 s
after the last mark, the score recomputes without a button

The whole pipeline

Marks go in by hand. Everything after that is recomputed, never typed.

Trigger or call Written by the recompute

The wait is on purpose: a consultant marking twenty objectives in a row gets one recompute after the last mark, not twenty racing each other.

1

Mark: the inputs a person sets

Everything the score depends on is either a person's mark or a person's written reason.

FieldOnSet by
Status: MET or NOT METEach objectiveThe consultant, from verified evidence
MET Basis: Enduring Exception or Temporary DeficiencyEach objective marked METThe consultant; the rollup never reads it
Applicability and its rationaleEach requirementThe consultant, only when the requirement genuinely cannot apply
Partial Credit and its rationaleOnly 3.5.3 and 3.13.11The consultant, when the partial condition is confirmed

Applicability and partial credit sit on the requirement row as separate fields because the requirement's status is computed and would overwrite them.

2

Recompute: in the order it runs

From scratch every time, so the result depends only on the marks, never on history.

  1. Refuse an empty assessment. No objectives means the wrong assessment or the wrong base; the run fails loudly instead of scoring nothing.
  2. Roll objectives up to requirements. Any NOT MET makes the requirement NOT MET. Only when every objective is exactly MET is the requirement MET; anything else, including a status it doesn't recognize, leaves it Not Yet Assessed.
  3. Record points. A MET requirement earns its full value; a not-applicable one earns nothing and loses nothing.
  4. Open a POA&M for each new eligible gap, linked to the exact objectives that failed. An ineligible gap is refused with the reason printed. An existing POA&M is never edited: its remediation plan, target date and notes belong to the consultant, who also closes it. If a requirement fails again after its POA&M was closed, a new one opens and the basis says why.
  5. Check the evidence behind every mark: Define objectives want a written statement, Perform objectives an artifact, and only human-verified evidence judged to satisfy the objective counts.
  6. Refresh the review console so its to-do counts match.
  7. Write the score, its basis, a dated snapshot and a projection. The basis names every gap that can't go on a POA&M, and adds a "needs attention" list: stale POA&Ms, a not-applicable with no reason, documents not yet reviewed. A snapshot identical to today's last one isn't repeated. If the score can't be written, the run fails and alerts, rather than leaving a stale score that reads as current.
3

Score: the rules, and where they come from

Regulation where the regulation speaks; our stated positions where it doesn't.

RuleSource
The maximum is the number of Level 2 requirements (110). Each requirement NOT MET subtracts its value, and the score can go negative.32 CFR 170.24
Values are 5, 3 or 1 by the effect of the requirement not being met. 3.5.3 (multi-factor authentication) and 3.13.11 (FIPS-validated encryption) can take a partial deduction of 3 instead of 5.32 CFR 170.24; DoD Assessment Methodology v1.2.1
A missing System Security Plan (3.12.4) means the assessment cannot be completed, so the score basis leads with that halt.DoD Assessment Methodology v1.2.1
Conditional status with a POA&M needs a score of at least 0.8 of the maximum: 88 at Level 2.32 CFR 170.21(a)(2)(i)
A POA&M may not include a requirement worth more than 1 point, except 3.13.11 at 3 when encryption is used but isn't FIPS-validated.32 CFR 170.21(a)(2)(ii)
Six requirements can never be on a POA&M: 3.1.20, 3.1.22, 3.12.4, 3.10.3, 3.10.4 and 3.10.5.32 CFR 170.21(a)(2)(iii)
No POA&M at all for a Level 1 self-assessment.32 CFR 170.21(a)(1)
A POA&M must be closed out within 180 days of the Conditional status date; the basis counts the days down when that date is set.32 CFR 170.21(b)
Our position: a requirement not yet assessed is scored as not met. Points come only from what has been proven.House rule
Our position: not applicable only when the environment is genuinely incapable of the requirement, never because a control is simply missing. The recompute flags an N/A with no written rationale.House rule

The 110-point score is computed only for NIST SP 800-171 Rev 2 and CMMC Level 2 assessments. Other frameworks get the rollup and POA&M rules but no 110-based number, rather than a misleading one.

Decision log

The calls that shaped marking and scoring, and when they were made.

DecisionWhyWhen
Recompute on every objective edit, automaticallyNo score should wait for a button2026-07-20
Settle for 90 seconds; write only verdicts that changedThe first version re-triggered itself every few seconds2026-07-21
Applicability as its own field; POA&Ms never edited by the jobA computed status can't hold a person's judgment2026-07-21
Points only for what's provenAn unassessed requirement is not a met one2026-07-23
Score only Rev 2 and Level 2; partial credit; a history of every scoreShow the trend, and never put a 110-based number on a framework it doesn't fit2026-07-29
MET Basis as a qualifier on METAn enduring exception is still MET; it needs recording, not a new status2026-09-12
POA&M eligibility, the Level 1 ban, the 180-day clock, the 3.12.4 haltBuilt from 32 CFR 170.21 and the DoD methodology, then checked against a synthetic client2026-09-16
Pass the client's base through the settling step; fail loudly on an empty assessment or an unwritten scoreThe automatic recompute had been scoring the template instead of the client, and finishing quietly2026-09-30
Refusals and stale items written into the basis; a busy automatic run retries; any workflow error alertsWhat only reached a log was effectively never seen2026-09-30

Known gaps