Training & Education

The CMMC Phase 2 pause has created confusion across the Defense Industrial Base. Join CUI Supply on July 29 for a free public webinar that separates fact from fiction, addresses common misconceptions, and helps contractors understand what they should be watching next.

The Department of War has paused the rollout of CMMC Phase 2, but that does not mean CMMC Level 2, NIST SP 800-171, DFARS requirements, or CUI safeguarding obligations have been canceled or suspended. Contractors should use this review period to close security gaps, maintain accurate self-assessments, and continue protecting Controlled Unclassified Information—not put compliance efforts on hold.

The CMMC Phase 2 pause has created new questions across the Defense Industrial Base. Learn what the announcement means, what requirements remain in effect, and how to join CUI Supply’s free customer-exclusive webinar.

CMMC Mythbusters is BACK June 2026! The popular CMMC 2.0/ DFARS training and education series CMMC Mythbusters returns June 16th- 17th, 2026! In three webinars, we will dive into the details of what is considered Controlled Unclassified Information (CUI), break down the definition of Commercial-off-the-Shelf (COTS), and work through how to properly identify and mark CUI. Leading the series is Regan Edens, Chairman of the CMMC Industry Standards Council (CISC) and Chief Transformation Officer of DTC Global. Use this opportunity to learn the latest requirements and ask the questions you need answered. Join us LIVE for CMMC Mythbusters June 16-18 below! Sign up for each part via the links below:  Part 1: "What Exactly Is CUI (Controlled Unclassified Information)?" Part 2: "Commercial-Off-the-Shelf (COTS) vs CUI?" Part 3: "Identifying & Properly Marking CUI" Brought to you by DTC Global, Cross Timbers APEX Accelerator, CUI Supply, TMAC, and the CMMC Industry Standards Council.

Not sure if your documents contain CUI? Use this exact 8-step checklist based on DoDI 5200.48 and dodcui.mil. Perfect for DoD contractors and CMMC compliance in 2026.

Printers, copiers, scanners, monitors, and shared workspaces can all become physical CUI exposure points if they are not properly controlled. NIST SP 800-171 Rev. 3 explicitly requires organizations to restrict physical access to output devices so unauthorized individuals cannot obtain Controlled Unclassified Information. This article breaks down what that means in practice, why shared office equipment creates real compliance risk, and how physical safeguards like coversheets, signs, labels, and controlled workspaces help protect CUI during everyday handling.

Controlled Unclassified Information (CUI) can be confusing, especially for organizations trying to understand what it is, who must protect it, and how physical marking fits into compliance. This FAQ answers common questions about CUI, including safeguarding requirements, physical CUI risks, marking practices, controlled environments, visitor access, and the practical steps organizations can take to improve compliance readiness.

What is the difference between SF 902 and SF 905 CUI labels? Both are used to mark computers, monitors, hard drives, and digital media that contain Controlled Unclassified Information, but SF 902 includes “U.S. Government Property” and SF 905 does not. This guide breaks down SF 902 vs. SF 905, explains when to use each label, and helps defense contractors and other organizations choose the right CUI device label for computers, digital media, and equipment.

How do you properly mark Controlled Unclassified Information? This guide explains how to identify, label, and protect CUI across documents, computers, digital media, manufacturing areas, and controlled workspaces. It covers core CUI marking requirements, best practices by media type, common audit-failure mistakes, and a simple step-by-step framework for building a consistent CUI marking program aligned with NIST SP 800-171, DFARS 252.204-7012, and CMMC.

If you work with the Department of Defense (DoD) or support the Defense Industrial Base (DIB), you’ve almost certainly heard the term CUI—but it’s also one of the most misunderstood concepts in compliance. Understanding Controlled Unclassified Information (CUI) is foundational to DFARS, NIST SP 800-171, and CMMC compliance. This guide breaks it down clearly and practically.

Does ITAR or EAR-controlled technical data count as CUI under a DoD contract? In many cases, yes. When export-controlled technical data or technology is provided by the government or generated during DoD contract performance, it may qualify as CUI and require proper marking, access controls, and physical safeguarding. This guide explains how ITAR, EAR, DFARS 252.204-7012, and CUI requirements intersect, what manufacturers need to protect, and how to reduce compliance risk in engineering, production, quality, and visitor-access areas.

CMMC Mythbusters is BACK December 2025! The popular CMMC 2.0/ DFARS training and education series CMMC Mythbusters returns December 15th- 19th, 2025! Once a six-part series, we have now condensed down to three parts, jam-packed with the latest updates and info you need to know to be compliant.  Join us live for the highly anticipated return of CMMC Mythbusters, led by the Chairman of the CMMC Industry Standards Council (CISC) and Chief Transformation Officer of DTC Global, Regan Edens. Sign up for each part via the links below:  Part 1: "What Exactly Is CUI (Controlled Unclassified Information)?" Part 2: "Commercial-Off-the-Shelf (COTS) vs CUI?" Part 3: "Identifying & Properly Marking CUI" This complimentary series is brought to by CUI Supply, DTC Global, and the University of Texas- Arlington. 

❗❗ATTENTION ❗ ❗CMMC Phase I officially begins NOVEMBER 10TH, 2025! If you haven't started preparing already, the time is NOW! We want to help you get ready. Get 10% off your order total, automatically applied at checkout, at CUISupply.com.DO NOT WAIT! Get ready NOW. To read more about the Final Rule, click HERE:

Important clarifications provided by the DoD were recently released on the CMMC Phase I timeline and the impact on contracts after the effective date. The deadline is September 2025... Are you ready?