CMMC Phase II Suspension: What Still Applies to CUI Document Workflows?
Keep safeguarding, self-assessment, contract requirements, and operating evidence connected
Published
CMMC stands for Cybersecurity Maturity Model Certification. It is a U.S. defence contracting programme for verifying that contractors and subcontractors have implemented the cybersecurity requirements needed to protect specified government information in their systems. Understanding the information, assessment level, and contract requirement comes before interpreting a change to the rollout timetable.
The pause in brief: On July 13, 2026, the department suspended the Phase II rollout planned for November 10, 2026 as part of a review of the programme. Phase I self-assessments and contractual safeguarding requirements continue. See below for what is paused and what still applies.
Consider a defence supplier that receives a controlled engineering drawing, creates a searchable preview, and sends an approved version to a machining subcontractor. CMMC concerns the security of the systems and processes handling that information. The document workflow matters because each preview, index, user, and transfer can affect the information boundary being assessed.
What is CMMC intended to verify?
CMMC gives the government a structured way to assess whether a supplier has implemented the required safeguards. Those safeguards cover more than document storage: access control, identification and authentication, staff awareness, configuration, incident response, and other security practices form part of the CMMC model.
The relevant organisation and defined information-system scope are assessed. Buying a document platform, using a particular cloud service, or writing a policy does not by itself establish the contractor's CMMC status. For example, a policy may say that only approved engineers can retrieve controlled drawings; the operating environment must enforce that rule, and the assessment evidence must show that it does.
Start with the solicitation, contract, and information the business will handle. A prime contractor supplies directly to the government; a subcontractor supplies part of the work through another contractor. Requirements can reach both through the contract chain. A small machining supplier can therefore have relevant obligations even when it has no direct government contract. Where the requirement applies, the contract specifies the CMMC status to obtain and maintain for the systems handling that work.
What are FCI and CUI?
These terms describe the information being protected. They are not labels for the size of a business or the quality of its software.
FCI: Federal Contract Information
FCI is nonpublic information supplied by or produced for the government under a contract for a product or service. Publicly released information and simple payment-transaction information are excluded. A nonpublic contract-performance schedule could be FCI, depending on its context.
CUI: Controlled Unclassified Information
CUI is unclassified information subject to safeguarding or dissemination controls under applicable law, regulation, or government-wide policy. Controlled technical information is one example. CUI is not classified national-security information, and an ordinary company confidentiality label does not automatically make a file CUI.
The drawing in our example might be controlled technical information if the applicable category and contract identify it that way. A public product brochure would be a different case. Confirm the category, markings, contractual instructions, and responsible authority rather than treating every engineering file as CUI or assuming an unmarked file is unrestricted.
CMMC levels describe protection; phases describe rollout
The framework has three levels, tied to the information and security requirements. They are not three dates on a calendar, and a business does not simply progress through all three as it grows.
| Level | What it addresses |
|---|---|
| Level 1 | Basic safeguarding of FCI, using the 15 requirements in Federal Acquisition Regulation (FAR) clause 52.204-21. |
| Level 2 | Protection of CUI, using the 110 requirements in National Institute of Standards and Technology (NIST) Special Publication 800-171 Revision 2. |
| Level 3 | Enhanced protection of CUI against advanced threats, adding selected NIST SP 800-172 requirements to the Level 2 foundation. |
An assessment evaluates implementation against those requirements. A self-assessment is performed by the organisation. The framework also defines Level 2 certification assessments by an authorised or accredited CMMC Third-Party Assessment Organization (C3PAO), and Level 3 assessments by the government's Defense Industrial Base Cybersecurity Assessment Center (DIBCAC). The assessment route is a separate question from the security level.
A phase is a step in introducing assessment requirements into defence procurement. Consequently, suspending Phase II is not the same as removing Level 2 safeguards for CUI. Distinguish the framework's available assessment routes from what the current rollout and a particular contract require.
What changed with the Phase II suspension?
On July 13, 2026, the department suspended Phase II requirements originally scheduled for November 10, 2026. Its CMMC program page describes a pause in Phase I, continuing self-assessment requirements, and enforcement against NIST SP 800-171 Revision 2 through self-assessments and selected government-led assessments.
The program page explicitly says the pause does not eliminate protection requirements under DFARS 252.204-7012. DFARS is the Defense Federal Acquisition Regulation Supplement: its clauses establish contractual requirements, while the referenced NIST publications provide the technical security requirements. CMMC supplies the assessment framework for verifying implementation. Recheck current program notices and the applicable contract before a bid, award, or system change.
Keep self-assessment and affirmation evidence current
The program page describes annual Level 1 self-assessment and affirmation, and Level 2 self-assessment every three years with annual affirmation. An affirmation is the authorised senior official's statement that the organisation continues to comply; it is distinct from carrying out the assessment. The Supplier Performance Risk System (SPRS) is the government system used for the relevant assessment and affirmation submissions.
A plan of action and milestones (POA&M) records permitted gaps and the work to close them. The programme permits only limited Level 2 POA&Ms, with closeout within 180 days; Level 1 does not permit them. Assign owners to assessment, affirmation, and remediation dates rather than treating the Phase II pause as an extension of every deadline.
Record the baseline used for each assessment and contract. NIST has superseded Revision 2 with Revision 3, while the CMMC program page cited here continues to specify Revision 2. Keep those publication and programme facts distinct. Preserve the version actually used and the basis for any approved change.
Trace the document through its full processing path
- 1 · Receive
Identify the record
Connect the source version, contract, handling instructions, owner, and accepted classification.
- 2 · Process
Track derived information
Map text extraction, previews, search, temporary files, logs, backups, and any approved AI processing.
- 3 · Release
Approve the destination
Verify the recipient, authorised version, transfer channel, applicable flow-down, and outcome.
Inventory components that store, process, transmit, or protect the covered information. NIST SP 800-171 Revision 2 describes that scope beyond the original repository. A preview service, index, support session, or backup path deserves an explicit place in the data-flow review.
Apply the authorised classification and handling rules to derivatives as well as source files. Route uncertain intake to a trained reviewer. A missing label should produce a review state, rather than automatically making an unknown document available to a wider audience.
Make the evidence useful to a reviewer
| Control question | Evidence relationship to retain |
|---|---|
| Where did the information go? | Current component inventory, data-flow version, service configuration, and responsible owner. |
| Who could retrieve it? | Identity, effective permissions, authentication policy, access-test result, and change history. |
| Which version was released? | Approved content version, recipient set, package manifest, release authority, and transfer outcome. |
| What supports the assessment? | Requirement and baseline, implementation description, dated operating evidence, test result, reviewer, and open remediation. |
Link evidence to the system state it demonstrates. A screenshot from an earlier configuration should remain recognisable as historical evidence. When access rules or integrations change, retain the change approval and retest the affected path before relying on the earlier result.
Review cloud services and subcontractor transfers
DFARS 252.204-7012(b)(2)(ii)(D) addresses external cloud providers storing, processing, or transmitting covered defence information: it requires security equivalent to the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline and compliance with the specified incident and forensic-support provisions. Evaluate the actual service boundary and contractual responsibilities. A provider's qualifying infrastructure does not establish the configuration or assessment status of every application deployed on it.
For subcontracting, paragraph (m) requires the clause to flow down when the stated conditions apply. Connect the contract review to the recipient identity, authorised information, and transfer route. Verify search results, previews, notifications, and export packages against the same audience decision as the original document.
Work through a controlled engineering change
Suppose a supplier receives revision C of a controlled drawing for an existing defence contract. Its approved environment creates a preview and searchable text. A subcontractor needs the drawing to quote a defined machining task. The following is a workflow test to adapt to the contract and assessment scope.
Bind intake to the contract
Record the received version, source, contract reference, handling instructions, and classification review. Identify which services will produce and store the preview and search text.
Check the permitted audience
Test an authorised engineer and an unrelated project user. Include direct download, search snippets, thumbnails, and administrative access in the test record.
Approve the subcontractor release
Confirm the subcontractor's contract need, applicable safeguarding requirements, approved channel, and recipient identity. Retain the exact released version and transfer outcome, distinguishing delivery from a recipient's recorded acknowledgement.
Handle a later correction
When revision D arrives, identify affected work and earlier recipients. Review the replacement release, update the relevant relationships, and retain revision C's distribution history. If an incident is suspected, invoke the incident process and preserve relevant evidence rather than treating a replacement file as incident resolution.
Keep incident reporting, investigation, and preservation procedures connected to the document workflow. Their triggers and deadlines come from the applicable clauses and response plan; routine document retention is a separate policy decision.
Test continuing controls during the pause
- Confirm the current programme notice, contract clauses, assessment level, and baseline.
- Track assessment, affirmation, SPRS submission, and applicable remediation dates.
- Reconcile source files, derivatives, indexes, temporary storage, backups, and support access with the boundary inventory.
- Verify cloud-service responsibilities and subcontractor flow-down before release.
- Test document, API, search, and export permissions with permitted and prohibited identities.
- Reconstruct one released version and the evidence supporting the latest assessment.
Keep the safeguarding record connected to the real system
Use the certification pause to keep the operating record current: the contract, information boundary, authorised audience, released version, and tested controls. Revisit that record when the programme changes or the environment expands.
Sources reviewed: November 12, 2026, including the CMMC model and assessment rules in 32 CFR Part 170, FAR 52.204-21, National Archives CUI guidance, the July 13 suspension announcement, CMMC program guidance, DFARS 252.204-7012, and NIST's Revision 2 publication. Check subsequent notices and contract-specific requirements before acting.