By Business Communication Solutions (BCS) | Technical review: October 23, 2026
Imagine spending months preparing for your CMMC Level 2 assessment. You purchased security tools, changed configurations, trained employees, and approved policies. Meanwhile, payroll still had to run and customers still needed your attention.
Then the assessment score comes back: 87.
One point below the minimum for Conditional CMMC Level 2 status. For a small business, that number can carry real anxiety about additional expenses, customer commitments, and the work still ahead.
At Business Communication Solutions, we want that conversation to happen before assessment day. Aim for 110. Understand the 88-point threshold. Leave room for the unexpected.
Watch: Why 87 vs. 88 Matters
Why 88 Matters—and Why the Score Alone Is Not Enough
Conditional Level 2 status requires a minimum score of 88 out of 110, and every remaining unmet requirement must qualify for a Plan of Action and Milestones (POA&M). A score of 87 makes conditional status unavailable. A score of 88 does not automatically make it available.
Generally, eligible POA&M items must be one-point requirements, with a limited exception for non-FIPS-validated encryption. Three-point and five-point gaps generally cannot be deferred through this mechanism.
Six requirements are specifically prohibited from a Level 2 assessment POA&M: external connections (3.1.20), control of public information (3.1.22), the System Security Plan (3.12.4), escorting visitors (3.10.3), physical access logs (3.10.4), and management of physical access (3.10.5). Level 1 assessment POA&Ms are not permitted. See 32 CFR § 170.21.
An Easy Mistake to Make: “Our Backups Are Encrypted, So We’re Covered”
The following is a hypothetical example, not a BCS customer incident.
An IT administrator opens the backup settings and shows the owner that encryption is enabled. “We’re using AES-256. We’re covered.” The owner feels relieved. Another requirement checked off.
Then the assessor asks: “Which FIPS-validated cryptographic module protects these backups, and where is the evidence that it covers this version and configuration?”
The team enabled encryption but assumed the algorithm name established FIPS validation. That assumption can leave a gap between what the business expects and what its evidence supports.
NIST explains that implementing an approved algorithm, even with algorithm validation certificates, does not by itself establish FIPS 140 cryptographic module validation. It recommends obtaining vendor confirmation of the applicable module and certificate, then checking the validation entry. See NIST’s guidance on validated modules.
How an Encryption Gap Could Turn 90 Into 87
Under CMMC requirement SC.L2-3.13.11, encryption that is employed but not FIPS-validated results in a three-point deduction. If encryption is not employed, the deduction is five points. These are the deductions specified in 32 CFR § 170.24.
Suppose the business expected a score of 90, having treated the encryption requirement as MET. If assessment identifies this additional three-point gap, the score becomes 87.
The non-FIPS-validated encryption case can qualify for a POA&M, but it does not waive the minimum score or other eligibility conditions. The exception cannot rescue a score below 88.
Synology Hyper Backup: Encryption and Validation Need Separate Verification
Synology documents AES-256 encryption in Hyper Backup. That capability alone does not establish FIPS validation for a particular backup-encryption implementation.
As of our October 23, 2026 review, we have not verified a completed FIPS 140 module validation covering Hyper Backup’s backup-encryption implementation. Synology’s June 3, 2026 DSM roadmap announcement describes FIPS 140-3 certification as in progress and says roadmap features will arrive progressively.
That announcement does not establish completed validation for an existing Hyper Backup installation. This is a product-function-specific evidence question; it should not be read as a claim that every Synology product or function lacks validated cryptography.
A roadmap helps you plan. An assessment needs evidence of what is implemented today. Request the applicable certificate number, module version, supported operating environment, and confirmation of which encryption operations are covered.
The 180-Day Deadline Includes Closeout
For Conditional Level 2 (C3PAO), remediation, the C3PAO closeout assessment, and posting the compliance results must occur within 180 days of the Conditional CMMC Status Date. Conditional status expires if successful closeout does not occur in that period. See 32 CFR § 170.17.
The closeout assessment addresses the unmet requirements identified on the initial assessment POA&M. Confirm pricing and scheduling with your C3PAO. A narrower assessment does not guarantee a particular fee.
What About Temporary Deficiencies?
Temporary deficiencies are a separate mechanism for fixable operational issues with a known correction available or in progress. They generally arise after implementation; the definition also allows limited rollout issues affecting a very small subset of equipment. They do not broadly cover an unfinished initial implementation. See 32 CFR § 170.4.
Under § 170.24, qualifying temporary deficiencies appropriately addressed in an operational plan of action are assessed as MET. The plan must include deficiency reviews and show progress toward correction. Simply labeling a missing capability “temporary” does not establish that it qualifies.
The BCS Approach: Verify Before Assessment Day
Our readiness recommendation is to ask what evidence supports each expected result. For encryption, identify the module, confirm the certificate and configuration, and retain the supporting documentation. For other requirements, test actual operation rather than relying only on a policy or a screenshot of a setting.
Prioritize gaps that prevent conditional eligibility, assign responsibility and funding for remaining work, and leave time for verification. An 88-point forecast leaves little room for an unexpected finding.
Your assessment represents real money and months of effort. Finding a gap early gives your business more time to choose a solution and protect the schedule.
CMMC Level 2 Readiness Support in Austin and Houston
Business Communication Solutions helps small businesses in Austin, Houston, and surrounding areas with CMMC gap assessments, implementation support, POA&M planning, and evidence preparation. BCS provides readiness support; the independent C3PAO determines certification assessment findings.
Start with a free initial cybersecurity risk assessment to discuss your environment and next steps.
Austin: 512-257-1433
Houston: 281-815-8784
Related reading: CMMC Consultant vs. C3PAO and Secure Device Baselines for SOC 2 and CMMC.