Training & Education

The Department of War suspended the transition to CMMC Phase II, but it did not suspend the obligation to protect Controlled Unclassified Information. Phase I self-assessment requirements remain in place, and contractors must still address applicable DFARS, NIST SP 800-171, CUI handling, documentation and supply-chain obligations. Here are seven costly mistakes defense contractors should correct during the pause.

CMMC Phase II is paused, but CMMC Phase I requirements remain in place. Defense contractors may still need Level 1 or Level 2 self-assessments, current SPRS records, annual affirmations, accurate assessment scopes, and continued protection of FCI and CUI.

The CMMC Phase II pause action plan gives defense contractors a practical 60-day roadmap to confirm requirements, map CUI, correct scope, strengthen safeguards, build evidence, and prepare for what comes next.

How do you properly mark Controlled Unclassified Information? This guide explains how to identify, label, and protect CUI across documents, computers, digital media, manufacturing areas, and controlled workspaces. It covers core CUI marking requirements, best practices by media type, common audit-failure mistakes, and a simple step-by-step framework for building a consistent CUI marking program aligned with NIST SP 800-171, DFARS 252.204-7012, and CMMC.