Training & Education

The Department of War suspended the transition to CMMC Phase II, but it did not suspend the obligation to protect Controlled Unclassified Information. Phase I self-assessment requirements remain in place, and contractors must still address applicable DFARS, NIST SP 800-171, CUI handling, documentation and supply-chain obligations. Here are seven costly mistakes defense contractors should correct during the pause.

CMMC Phase II is paused, but CMMC Phase I requirements remain in place. Defense contractors may still need Level 1 or Level 2 self-assessments, current SPRS records, annual affirmations, accurate assessment scopes, and continued protection of FCI and CUI.

The CMMC Phase II pause action plan gives defense contractors a practical 60-day roadmap to confirm requirements, map CUI, correct scope, strengthen safeguards, build evidence, and prepare for what comes next.

Watch CUI Supply’s recorded discussion about the CMMC Phase 2 pause, the confusion surrounding the announcement, and what defense contractors should consider before changing their compliance plans.

The CMMC Phase 2 pause has created confusion across the Defense Industrial Base. Join CUI Supply on July 29 for a free public webinar that separates fact from fiction, addresses common misconceptions, and helps contractors understand what they should be watching next.

The Department of War has paused the rollout of CMMC Phase 2, but that does not mean CMMC Level 2, NIST SP 800-171, DFARS requirements, or CUI safeguarding obligations have been canceled or suspended. Contractors should use this review period to close security gaps, maintain accurate self-assessments, and continue protecting Controlled Unclassified Information—not put compliance efforts on hold.

The CMMC Phase 2 pause has created new questions across the Defense Industrial Base. Learn what the announcement means, what requirements remain in effect, and how to join CUI Supply’s free customer-exclusive webinar.

During work hours, keep CUI under the control of authorized people and do not leave it where unauthorized people can access, view, or overhear it. After hours, decide storage based on whether the facility provides continuous monitoring of access. If it does, unlocked desks, cabinets, or containers may be acceptable under the DoD rule. If it does not, use locked desks, file cabinets, bookcases, locked rooms, or similarly secured areas.

European manufacturers and engineering firms supporting U.S. defense programs may be required to protect Controlled Unclassified Information, even when operating outside the United States. This article explains why CUI requirements travel with U.S. technical data, where physical compliance gaps often appear, and how EU facilities can prepare for U.S. defense supply chain expectations.

CMMC Mythbusters is BACK June 2026! The popular CMMC 2.0/ DFARS training and education series CMMC Mythbusters returns June 16th- 17th, 2026! In three webinars, we will dive into the details of what is considered Controlled Unclassified Information (CUI), break down the definition of Commercial-off-the-Shelf (COTS), and work through how to properly identify and mark CUI. Leading the series is Regan Edens, Chairman of the CMMC Industry Standards Council (CISC) and Chief Transformation Officer of DTC Global. Use this opportunity to learn the latest requirements and ask the questions you need answered. Join us LIVE for CMMC Mythbusters June 16-18 below! Sign up for each part via the links below:  Part 1: "What Exactly Is CUI (Controlled Unclassified Information)?" Part 2: "Commercial-Off-the-Shelf (COTS) vs CUI?" Part 3: "Identifying & Properly Marking CUI" Brought to you by DTC Global, Cross Timbers APEX Accelerator, CUI Supply, TMAC, and the CMMC Industry Standards Council.

Defense contractors preparing for CMMC Phase 2 should not wait until the last minute to evaluate the physical side of their environment. Now is the time to walk the facility, examine workflows, identify ambiguity, and ask whether the environment itself supports compliant behavior. Because in the end, physical safeguarding is not just about having rules. It is about creating an environment where the right actions are obvious, repeatable, and defensible. That is what assessment-ready physical CUI protection looks like.

When employees handle Controlled Unclassified Information in paper form, the risk is not limited to cybersecurity. Printed documents, binders, folders, travelers, drawings, and work packets can all expose CUI if they are left uncovered, misplaced, casually observed, or mixed into normal paperwork. That is where the SF 901 CUI Cover Sheet becomes useful. The SF 901 Cover Sheet is designed to sit on top of physical CUI documents and help alert personnel that the attached material requires safeguarding. It creates a clear visual indicator that the document packet contains CUI and should be handled according to the organization’s CUI procedures. For defense contractors, manufacturers, engineering firms, program offices, and other organizations supporting federal contracts, SF 901 Cover Sheets are one of the simplest ways to improve physical CUI handling. What Is an SF 901 CUI Cover Sheet? An SF 901 CUI Cover Sheet is the standard cover sheet used to identify and help protect physical documents containing Controlled Unclassified Information. It is commonly placed on top of printed CUI documents, document packets, folders, binders, clipboards, travelers, and other physical paperwork. The purpose is to make it immediately clear that the material underneath requires proper handling. The cover sheet can also provide space for additional handling details, such as: CUI categories Limited dissemination controls Special instructions Points of contact Internal handling notes The SF 901 is an acceptable alternative to marking a document as long it stays attached to the document. This works as an additional visual layer to help employees recognize, cover, and protect CUI during normal operations. When Should You Use SF 901 Cover Sheets? Use SF 901 Cover Sheets any time printed CUI documents need to be handled, reviewed, moved, staged, or stored. Common use cases include: Printed CUI documents on desks or workstations Engineering drawings or technical data Manufacturing travelers Quality inspection packets Contract files Program management binders Meeting handouts Documents being transported between departments CUI stored in folders, cabinets, or bins Printed documents waiting to be scanned, filed, shredded, or reviewed They are especially helpful in environments where CUI moves between people, departments, or physical work areas. For example, a manufacturing company may use SF 901 Cover Sheets on traveler packets that move from engineering to production to inspection. A program office may use them on printed contract documents. An FSO or ISSO may use them during internal audits, employee training, or CUI handling reviews. Where Should the Cover Sheet Be Placed? The SF 901 Cover Sheet should be placed on top of the CUI document packet so it is immediately visible. For best results, use it in a consistent way across your organization: Place it as the first page of printed CUI packets. Keep it facing outward when documents are in folders or binders. Use it on clipboards or packets moving through production areas. Keep it attached while the document still requires protection. Store covered documents in approved cabinets, folders, or controlled areas when not in use. The goal is simple: when someone sees the document packet, they should immediately understand that the material requires CUI handling procedures. Step-by-Step: How to Use SF 901 Cover Sheets Step 1: Identify the CUI Document Before applying a cover sheet, determine whether the document contains Controlled Unclassified Information. This may include contract information, technical data, export-controlled information, drawings, specifications, program details, inspection records, or other controlled information provided by or created for a federal contract. Step 2: Make Sure the Document Is Properly Marked The SF 901 Cover Sheet is not a replacement for proper CUI markings on the document itself. If the document requires CUI markings, make sure the underlying document is marked according to your organization’s CUI marking procedures and applicable contract requirements. Step 3: Place the SF 901 Cover Sheet on Top Place the cover sheet on top of the document packet, folder, binder, clipboard, or traveler. The CUI cover sheet should be clearly visible. Step 4: Fill In Handling Details in the Designation Indicator Block Use the available space on the cover sheet to add relevant details such as CUI category, limited dissemination control, special handling instructions, or a point of contact. Not every organization will fill in every field every time. Your internal SOP should define what is required. Step 5: Keep the Cover Sheet Attached Keep the SF 901 Cover Sheet attached while the document requires protection, is being actively used, or is being transported, stored, reviewed, or staged. Step 6: Store or Destroy the Document Properly When CUI documents are not in active use, store them in an approved location. When they are no longer needed, dispose of them using your approved CUI destruction process. Do not place CUI documents in normal trash or recycling. Common Mistakes to Avoid Mistake 1: Treating the Cover Sheet as the Only Required Marking A cover sheet helps identify and protect CUI, but it does not automatically make the underlying document properly marked. The document itself may still need required CUI markings. Mistake 2: Leaving Covered CUI in Public Areas A cover sheet helps reduce casual observation, but it does not make it acceptable to leave CUI in uncontrolled spaces. Covered documents should still be handled, stored, and protected according to your CUI procedures. Mistake 3: Using Cover Sheets Inconsistently If some employees use cover sheets and others do not, your process becomes harder to follow and harder to audit. The best practice is to define when SF 901 Cover Sheets are required in your SOP for consistent marking.  Mistake 4: Forgetting About Manufacturing and Production Areas CUI is not only found in offices. Printed work instructions, drawings, travelers, inspection documents, and technical packets may contain CUI in production environments. SF 901 Cover Sheets can help make these documents easier to identify on the floor. Mistake 5: Throwing CUI Documents in Normal Trash Once a CUI document is printed, it needs to be controlled through its full lifecycle. That includes destruction. You are required to properly destroy any CUI once it has reached the end of its lifecycle. Pair SF 901 Cover Sheets with CUI authorized destruction container signs to remind employees where CUI documents should go when they are ready for disposal.  Where SF 901 Cover Sheets Fit in a Complete CUI Marking System SF 901 Cover Sheets are one part of a broader physical CUI protection system. They work best when paired with other visual controls, including: CUI folders for organizing and identifying document packets CUI restricted area signs for rooms or areas where CUI is handled CUI authorized-only floor tape for controlled work zones CUI media labels for devices and removable media CUI destruction container signs for approved disposal points CUI visitor badges for access control and visitor awareness CUI awareness posters for employee reminders and training reinforcement The cover sheet identifies the document. The surrounding signs, labels, badges, and floor markings help define the environment where that document is handled. Together, they create a more consistent and visible CUI handling process. Example Use Cases by Environment Office Environment Use SF 901 Cover Sheets on printed contracts, program binders, meeting packets, review documents, and files containing CUI. Keep covered documents in approved folders, drawers, or storage cabinets when not in use. Manufacturing Floor Use SF 901 Cover Sheets on travelers, work instructions, inspection packets, drawings, and technical documents that move between workstations. Pair with CUI restricted area signs and CUI floor markings to identify controlled production zones. Engineering Department Use SF 901 Cover Sheets on printed drawings, design reviews, technical data packages, prototype documentation, and customer-provided CUI that is not or cannot be properly marked. Pair with CUI media labels for engineering workstations and removable storage devices. Conference Rooms Use SF 901 Cover Sheets on CUI meeting packets, agenda attachments, program documentation, and technical review materials. Remove or secure all CUI documents after the meeting ends. Reception or Visitor Areas Avoid staging exposed CUI documents in reception areas. If CUI documents must move through visitor-facing spaces, use a cover sheet and follow your organization’s escort and handling procedures. Suggested SOP Language Here is a simple paragraph you can adapt for your internal procedure: “Employees must use SF 901 CUI Cover Sheets on physical document packets containing Controlled Unclassified Information when unmarked CUI documents are printed, reviewed, stored, or staged. The cover sheet must be placed on top of the document packet and remain attached while the document requires protection. SF 901 Cover Sheets do not replace required CUI markings on the underlying document. CUI documents must be stored, transported, reproduced, and destroyed according to the organization’s CUI handling procedures.” Quick Buyer Recommendation If your team prints, reviews, files, transports, or stores CUI documents, SF 901 Cover Sheets should be part of your physical CUI handling process. They are especially important for organizations preparing for CMMC, internal audits, supplier reviews, CUI training, or facility standardization. Start by placing SF 901 Cover Sheets in the areas where CUI documents are most often printed, handled, transported, or stored. Then build outward by adding folders, signage, media labels, destruction container signs, and controlled area markings. FAQ Are SF 901 Cover Sheets required? CUI is required to be marked. However, when a CUI cover sheet is used, the official SF 901 is the standard CUI cover sheet. Do SF 901 Cover Sheets replace CUI markings? Yes. This is an alternate marking method for when editing the CUI document is not permitted.  Can SF 901 Cover Sheets be used in manufacturing environments? Yes. They are useful for travelers, drawings, work instructions, quality packets, technical documents, and other printed materials that may move through production, inspection, engineering, or program areas. Should the cover sheet stay attached to the document? Yes. Absolutely, the cover sheet should remain attached while the document requires protection, is being handled, or is being stored. What products should be used with SF 901 Cover Sheets? Common pairings include CUI folders, CUI restricted area signs, CUI destruction container signs, CUI media labels, CUI authorized-only floor tape, and visitor/personnel badges.

Not sure if your documents contain CUI? Use this exact 8-step checklist based on DoDI 5200.48 and dodcui.mil. Perfect for DoD contractors and CMMC compliance in 2026.

Printers, copiers, scanners, monitors, and shared workspaces can all become physical CUI exposure points if they are not properly controlled. NIST SP 800-171 Rev. 3 explicitly requires organizations to restrict physical access to output devices so unauthorized individuals cannot obtain Controlled Unclassified Information. This article breaks down what that means in practice, why shared office equipment creates real compliance risk, and how physical safeguards like coversheets, signs, labels, and controlled workspaces help protect CUI during everyday handling.

What is the ROI of proper CUI marking for CMMC compliance? For most defense contractors, the cost of implementing CUI signs, labels, coversheets, stamps, and basic visual controls is relatively low, while the benefits can be significant. Proper CUI marking helps reduce audit findings, prevent mishandling, improve operational clarity, and build customer confidence. This article explains the true cost vs. benefit of a professional CUI marking program and why it is one of the smartest low-cost investments an organization can make for CMMC readiness.

Controlled Unclassified Information (CUI) can be confusing, especially for organizations trying to understand what it is, who must protect it, and how physical marking fits into compliance. This FAQ answers common questions about CUI, including safeguarding requirements, physical CUI risks, marking practices, controlled environments, visitor access, and the practical steps organizations can take to improve compliance readiness.