Training & Education

CMMC Phase 2 and CMMC Level 2 refer to two different parts of the Cybersecurity Maturity Model Certification program. Phase 2 is an implementation stage, while Level 2 is a cybersecurity assessment level for organizations that handle Controlled Unclassified Information. Here is what defense contractors need to understand—especially following the 2026 suspension of Phase 2.

The Department of War suspended the transition to CMMC Phase II, but it did not suspend the obligation to protect Controlled Unclassified Information. Phase I self-assessment requirements remain in place, and contractors must still address applicable DFARS, NIST SP 800-171, CUI handling, documentation and supply-chain obligations. Here are seven costly mistakes defense contractors should correct during the pause.

CMMC Phase II is paused, but CMMC Phase I requirements remain in place. Defense contractors may still need Level 1 or Level 2 self-assessments, current SPRS records, annual affirmations, accurate assessment scopes, and continued protection of FCI and CUI.

The CMMC Phase II pause action plan gives defense contractors a practical 60-day roadmap to confirm requirements, map CUI, correct scope, strengthen safeguards, build evidence, and prepare for what comes next.

Watch CUI Supply’s recorded discussion about the CMMC Phase 2 pause, the confusion surrounding the announcement, and what defense contractors should consider before changing their compliance plans.

The CMMC Phase 2 pause has created confusion across the Defense Industrial Base. Join CUI Supply on July 29 for a free public webinar that separates fact from fiction, addresses common misconceptions, and helps contractors understand what they should be watching next.

The Department of War has paused the rollout of CMMC Phase 2, but that does not mean CMMC Level 2, NIST SP 800-171, DFARS requirements, or CUI safeguarding obligations have been canceled or suspended. Contractors should use this review period to close security gaps, maintain accurate self-assessments, and continue protecting Controlled Unclassified Information—not put compliance efforts on hold.

The CMMC Phase 2 pause has created new questions across the Defense Industrial Base. Learn what the announcement means, what requirements remain in effect, and how to join CUI Supply’s free customer-exclusive webinar.

During work hours, keep CUI under the control of authorized people and do not leave it where unauthorized people can access, view, or overhear it. After hours, decide storage based on whether the facility provides continuous monitoring of access. If it does, unlocked desks, cabinets, or containers may be acceptable under the DoD rule. If it does not, use locked desks, file cabinets, bookcases, locked rooms, or similarly secured areas.

European manufacturers and engineering firms supporting U.S. defense programs may be required to protect Controlled Unclassified Information, even when operating outside the United States. This article explains why CUI requirements travel with U.S. technical data, where physical compliance gaps often appear, and how EU facilities can prepare for U.S. defense supply chain expectations.

If your space does not clearly prevent unauthorized people from entering, seeing, or hearing CUI, it is probably not yet a true controlled environment. That is the gap organizations should be working to close.

CMMC Mythbusters is BACK June 2026! The popular CMMC 2.0/ DFARS training and education series CMMC Mythbusters returns June 16th- 17th, 2026! In three webinars, we will dive into the details of what is considered Controlled Unclassified Information (CUI), break down the definition of Commercial-off-the-Shelf (COTS), and work through how to properly identify and mark CUI. Leading the series is Regan Edens, Chairman of the CMMC Industry Standards Council (CISC) and Chief Transformation Officer of DTC Global. Use this opportunity to learn the latest requirements and ask the questions you need answered. Join us LIVE for CMMC Mythbusters June 16-18 below! Sign up for each part via the links below:  Part 1: "What Exactly Is CUI (Controlled Unclassified Information)?" Part 2: "Commercial-Off-the-Shelf (COTS) vs CUI?" Part 3: "Identifying & Properly Marking CUI" Brought to you by DTC Global, Cross Timbers APEX Accelerator, CUI Supply, TMAC, and the CMMC Industry Standards Council.

Step-by-step 2026 guide to DoD CUI marking per DoDI 5200.48. Learn exact CUI banner rules, Designation Indicator block, portion markings, top categories, and common contractor mistakes to pass CMMC audits.

Not sure if your documents contain CUI? Use this exact 8-step checklist based on DoDI 5200.48 and dodcui.mil. Perfect for DoD contractors and CMMC compliance in 2026.

Printers, copiers, scanners, monitors, and shared workspaces can all become physical CUI exposure points if they are not properly controlled. NIST SP 800-171 Rev. 3 explicitly requires organizations to restrict physical access to output devices so unauthorized individuals cannot obtain Controlled Unclassified Information. This article breaks down what that means in practice, why shared office equipment creates real compliance risk, and how physical safeguards like coversheets, signs, labels, and controlled workspaces help protect CUI during everyday handling.

Controlled Unclassified Information (CUI) can be confusing, especially for organizations trying to understand what it is, who must protect it, and how physical marking fits into compliance. This FAQ answers common questions about CUI, including safeguarding requirements, physical CUI risks, marking practices, controlled environments, visitor access, and the practical steps organizations can take to improve compliance readiness.

What is the difference between SF 902 and SF 905 CUI labels? Both are used to mark computers, monitors, hard drives, and digital media that contain Controlled Unclassified Information, but SF 902 includes “U.S. Government Property” and SF 905 does not. This guide breaks down SF 902 vs. SF 905, explains when to use each label, and helps defense contractors and other organizations choose the right CUI device label for computers, digital media, and equipment.

How do you properly mark Controlled Unclassified Information? This guide explains how to identify, label, and protect CUI across documents, computers, digital media, manufacturing areas, and controlled workspaces. It covers core CUI marking requirements, best practices by media type, common audit-failure mistakes, and a simple step-by-step framework for building a consistent CUI marking program aligned with NIST SP 800-171, DFARS 252.204-7012, and CMMC.