Training & Education

The Department of War has paused the rollout of CMMC Phase 2, but that does not mean CMMC Level 2, NIST SP 800-171, DFARS requirements, or CUI safeguarding obligations have been canceled or suspended. Contractors should use this review period to close security gaps, maintain accurate self-assessments, and continue protecting Controlled Unclassified Information—not put compliance efforts on hold.

During work hours, keep CUI under the control of authorized people and do not leave it where unauthorized people can access, view, or overhear it. After hours, decide storage based on whether the facility provides continuous monitoring of access. If it does, unlocked desks, cabinets, or containers may be acceptable under the DoD rule. If it does not, use locked desks, file cabinets, bookcases, locked rooms, or similarly secured areas.

European manufacturers and engineering firms supporting U.S. defense programs may be required to protect Controlled Unclassified Information, even when operating outside the United States. This article explains why CUI requirements travel with U.S. technical data, where physical compliance gaps often appear, and how EU facilities can prepare for U.S. defense supply chain expectations.

Not sure if your documents contain CUI? Use this exact 8-step checklist based on DoDI 5200.48 and dodcui.mil. Perfect for DoD contractors and CMMC compliance in 2026.