Training & Education

CMMC Phase 2 and CMMC Level 2 refer to two different parts of the Cybersecurity Maturity Model Certification program. Phase 2 is an implementation stage, while Level 2 is a cybersecurity assessment level for organizations that handle Controlled Unclassified Information. Here is what defense contractors need to understand—especially following the 2026 suspension of Phase 2.

The Department of War suspended the transition to CMMC Phase II, but it did not suspend the obligation to protect Controlled Unclassified Information. Phase I self-assessment requirements remain in place, and contractors must still address applicable DFARS, NIST SP 800-171, CUI handling, documentation and supply-chain obligations. Here are seven costly mistakes defense contractors should correct during the pause.

CMMC Phase II is paused, but CMMC Phase I requirements remain in place. Defense contractors may still need Level 1 or Level 2 self-assessments, current SPRS records, annual affirmations, accurate assessment scopes, and continued protection of FCI and CUI.

The CMMC Phase II pause action plan gives defense contractors a practical 60-day roadmap to confirm requirements, map CUI, correct scope, strengthen safeguards, build evidence, and prepare for what comes next.

Watch CUI Supply’s recorded discussion about the CMMC Phase 2 pause, the confusion surrounding the announcement, and what defense contractors should consider before changing their compliance plans.

The CMMC Phase 2 pause has created confusion across the Defense Industrial Base. Join CUI Supply on July 29 for a free public webinar that separates fact from fiction, addresses common misconceptions, and helps contractors understand what they should be watching next.

The CMMC Phase 2 pause has created new questions across the Defense Industrial Base. Learn what the announcement means, what requirements remain in effect, and how to join CUI Supply’s free customer-exclusive webinar.

How do you properly mark Controlled Unclassified Information? This guide explains how to identify, label, and protect CUI across documents, computers, digital media, manufacturing areas, and controlled workspaces. It covers core CUI marking requirements, best practices by media type, common audit-failure mistakes, and a simple step-by-step framework for building a consistent CUI marking program aligned with NIST SP 800-171, DFARS 252.204-7012, and CMMC.

If you work with the Department of Defense (DoD) or support the Defense Industrial Base (DIB), you’ve almost certainly heard the term CUI—but it’s also one of the most misunderstood concepts in compliance. Understanding Controlled Unclassified Information (CUI) is foundational to DFARS, NIST SP 800-171, and CMMC compliance. This guide breaks it down clearly and practically.

Does ITAR or EAR-controlled technical data count as CUI under a DoD contract? In many cases, yes. When export-controlled technical data or technology is provided by the government or generated during DoD contract performance, it may qualify as CUI and require proper marking, access controls, and physical safeguarding. This guide explains how ITAR, EAR, DFARS 252.204-7012, and CUI requirements intersect, what manufacturers need to protect, and how to reduce compliance risk in engineering, production, quality, and visitor-access areas.

A common misconception is that ITAR or EAR compliance is separate from CUI or CMMC. Export-controlled information that is used, generated, or required for performance of a DoD contract qualifies as CUI. This FAQ answer offers authoritative, cited guidance from key regulations (32 CFR Part 2002, DoD Instructions 5200.48 and 5230.24, NARA CUI Registry) to ensure proper identification, marking, and facility-based protections of this highly regulated technical information. For DoD contractors, export-controlled technical data and technology under ITAR and EAR qualify as Controlled Unclassified Information (CUI) in the Export Control (EXPT) category when provided by or generated during DoD contract performance, requiring proper CUI marking (e.g., DoD marking guidance) on all documents, files, and media to prevent unauthorized disclosure.  This same information demands robust safeguarding through designated CUI Zones—controlled physical and digital areas (such as engineering offices, manufacturing floors, quality/test labs, and visitor access points) equipped with signage, labeling, access controls, and visual/perceptual barriers to protect against inadvertent exposure to unauthorized persons, including foreign nationals restricted under ITAR/EAR. These marking and zoning requirements are integral to DFARS 252.204-7012 and CMMC compliance, combining ITAR/EAR access restrictions with CUI safeguarding obligations; failing to treat them as unified can lead to compliance gaps and contract risks.  On U.S. Department of Defense (DoD) contracts, technical data and technology controlled under the International Traffic in Arms Regulations (ITAR) and the Export Administration Regulations (EAR) qualify as Controlled Unclassified Information (CUI) when they are used, generated, or handled in support of contract performance. This is because DoD policy explicitly requires that export-controlled information be protected as CUI to prevent unauthorized disclosure, including disclosure to unauthorized foreign persons. When implementing DFARS 252.204-7012 and preparing for CMMC certification you must implement DoD policy

CMMC Mythbusters is BACK December 2025! The popular CMMC 2.0/ DFARS training and education series CMMC Mythbusters returns December 15th- 19th, 2025! Once a six-part series, we have now condensed down to three parts, jam-packed with the latest updates and info you need to know to be compliant.  Join us live for the highly anticipated return of CMMC Mythbusters, led by the Chairman of the CMMC Industry Standards Council (CISC) and Chief Transformation Officer of DTC Global, Regan Edens. Sign up for each part via the links below:  Part 1: "What Exactly Is CUI (Controlled Unclassified Information)?" Part 2: "Commercial-Off-the-Shelf (COTS) vs CUI?" Part 3: "Identifying & Properly Marking CUI" This complimentary series is brought to by CUI Supply, DTC Global, and the University of Texas- Arlington.