Training & Education

The Department of War suspended the transition to CMMC Phase II, but it did not suspend the obligation to protect Controlled Unclassified Information. Phase I self-assessment requirements remain in place, and contractors must still address applicable DFARS, NIST SP 800-171, CUI handling, documentation and supply-chain obligations. Here are seven costly mistakes defense contractors should correct during the pause.

CMMC Phase II is paused, but CMMC Phase I requirements remain in place. Defense contractors may still need Level 1 or Level 2 self-assessments, current SPRS records, annual affirmations, accurate assessment scopes, and continued protection of FCI and CUI.

The CMMC Phase II pause action plan gives defense contractors a practical 60-day roadmap to confirm requirements, map CUI, correct scope, strengthen safeguards, build evidence, and prepare for what comes next.

The CMMC Phase 2 pause has created new questions across the Defense Industrial Base. Learn what the announcement means, what requirements remain in effect, and how to join CUI Supply’s free customer-exclusive webinar.

What is the difference between SF 902 and SF 905 CUI labels? Both are used to mark computers, monitors, hard drives, and digital media that contain Controlled Unclassified Information, but SF 902 includes “U.S. Government Property” and SF 905 does not. This guide breaks down SF 902 vs. SF 905, explains when to use each label, and helps defense contractors and other organizations choose the right CUI device label for computers, digital media, and equipment.