Training & Education

The Department of War has paused the rollout of CMMC Phase 2, but that does not mean CMMC Level 2, NIST SP 800-171, DFARS requirements, or CUI safeguarding obligations have been canceled or suspended. Contractors should use this review period to close security gaps, maintain accurate self-assessments, and continue protecting Controlled Unclassified Information—not put compliance efforts on hold.

During work hours, keep CUI under the control of authorized people and do not leave it where unauthorized people can access, view, or overhear it. After hours, decide storage based on whether the facility provides continuous monitoring of access. If it does, unlocked desks, cabinets, or containers may be acceptable under the DoD rule. If it does not, use locked desks, file cabinets, bookcases, locked rooms, or similarly secured areas.