must be closed within 180 days, cannot apply to highest-weighted requirements, minimum assessment score required). This offers some flexibility but does not eliminate the need for robust CMMC compliance. Cost I