Current status: CMMC Phase 2 is suspended
On July 13, 2026, the Department of War (DoD) announced the suspension of CMMC Phase 2, which was scheduled to begin November 10, 2026. Program offices cannot designate Level 2 (C3PAO) or Level 3 (DIBCAC) assessments while it lasts, and contracting activities were directed to remove those requirements from solicitations and existing contracts. A CMMC Reform Task Force is reviewing the program, and no restart date has been announced. Read the DoD announcement.
The suspension does not withdraw the program rule. Level 1 and Level 2 self-assessments, SPRS reporting, annual affirmations, DFARS 252.204-7012 and NIST SP 800-171 Revision 2 all continue to apply where your contracts require them, and primes can keep their own third-party requirements. This status was last checked on November 6, 2026.
Federal Contract Information is information not intended for public release, provided by or generated for the government under a contract to develop or deliver a product or service. The definition lives in FAR 52.204-21. It excludes information the government makes public and simple transactional information such as what is necessary to process payments.
Controlled Unclassified Information is a narrower and more formal category: information the government creates or possesses, or that an entity creates or possesses for the government, that a law, regulation or government-wide policy requires to be safeguarded or disseminated under controls. It is defined in 32 CFR part 2002, and the authoritative list of what qualifies is the NARA CUI Registry.
The practical relationship is one of nesting and scale. Almost any non-public information exchanged under a contract is FCI. Only some of it rises to CUI, and when it does, a specific legal authority is the reason.
Side by side
| FCI | CUI | |
|---|---|---|
| Defined in | FAR 52.204-21 | 32 CFR part 2002; categories in the NARA CUI Registry |
| What makes it protected | It is not intended for public release and arises under a contract | A law, regulation or government-wide policy requires safeguarding |
| Typically marked? | No — there is no FCI marking scheme | Yes — the government is responsible for identifying and marking it |
| How common | Nearly universal across federal contracts | Limited to contracts involving specific categories of sensitive information |
| Points toward | CMMC Level 1 | CMMC Level 2 (or Level 3 on the highest-priority programs) |
| Security requirements | 15 requirements from FAR 52.204-21 | 110 requirements from NIST SP 800-171 Revision 2 |
Confirm current requirement counts and level mappings against 32 CFR part 170 before relying on them for planning.
What each looks like in practice
Abstraction is where contractors go wrong on this, so it is worth being concrete.
Likely FCI
An unclassified statement of work the government sent you under a contract. Email correspondence with a contracting officer about delivery schedules. Draft deliverables produced under the contract. Internal process documents you generated specifically to perform the work.
None of this is marked. None of it is dramatic. It is simply information that arose under the contract and that the government has not published — which is enough to make it FCI.
Likely CUI
Technical drawings or specifications subject to export control. Detailed information about the design, operation or vulnerabilities of a defense system. Certain categories of personally identifiable information. Information the government has marked "CUI" and delivered to you under a contract containing DFARS 252.204-7012.
The common thread is that some authority outside the contract — an export control regulation, a privacy statute, a government-wide policy — requires the information be protected.
The marking is a signal, not the whole test
The government is responsible for identifying and marking CUI. In practice, marking is inconsistent, and unmarked information that meets a CUI category does not stop being CUI because someone forgot a header. If the nature of the information suggests CUI and your contract contains the safeguarding clauses, raise it with your contracting officer rather than treating the absence of a marking as a clearance.
How to work out which you hold
This is a documentary exercise, not a judgment call. Work through it in order.
- 1
Read your contracts for the safeguarding clauses
Search each active DoD contract for DFARS 252.204-7012, 252.204-7019 and 252.204-7020. Treat these as a starting point: 7012 appears in nearly every DoD contract except those solely for COTS items, so its presence alone does not mean you hold CUI.
- 2
Inventory what the government actually sends you
Go through deliverables, attachments, drawings, data packages and correspondence. Look for CUI markings, export control notices, or distribution statements limiting release.
- 3
Check the categories against the registry
For anything ambiguous, compare it against the NARA CUI Registry. The registry is organized by category and tells you which authority drives the protection requirement.
- 4
Ask, in writing
If you cannot resolve it, ask the contracting officer whether the contract involves CUI and how it should be marked. This is a legitimate question and the answer belongs in the contract file. Do not guess, and do not rely on a verbal assurance.
- 5
Ask the same of your primes
If you work as a subcontractor, the flow-down determines your obligation. Ask each prime what data types they intend to pass you, and what CMMC level they expect their supply chain to meet.
Why the distinction is worth this much effort
The gap between the two obligations is not incremental. Level 1 covers 15 requirements, is self-assessed, and a well-run small company can often reach it with focused internal effort. Level 2 covers 110 requirements, can require a third-party assessment when a contract or prime calls for one, and typically involves system architecture changes, formal documentation, evidence collection and outside cost.
Two failure modes follow, and both are expensive. Companies that assume they handle CUI when they do not spend money and months on an obligation they never had. Companies that assume they do not handle CUI when they do discover the gap during a pursuit, when there is no time left to close it.
Scope is a lever
Where CUI genuinely is in play, the question is not only whether you comply but where the CUI lives. Deliberately limiting the systems that store and process CUI reduces the environment subject to assessment. That architectural decision is often a major driver of what Level 2 costs a small company.
Tie this back to the work you want
Which category you handle is a function of which contracts you hold and which you are chasing. If you are deciding how much compliance to take on, look at the actual shape of your target pipeline first.
Understand your defense pipeline
- Contract Awards Explorer
Examine historical awards in your NAICS to see which programs and agencies your work sits alongside.
- Federal Agency Profiles
Identify which defense buying organizations purchase your capability.
Sources
- FAR 52.204-21 — Basic Safeguarding of Covered Contractor Information Systems — defines FCI
- NARA CUI Registry — The authoritative list of CUI categories
- 32 CFR Part 2002 — Controlled Unclassified Information — The government-wide CUI program rule
- DFARS 252.204-7012 — Safeguarding Covered Defense Information and Cyber Incident Reporting
- 32 CFR Part 170 — CMMC Program — The rule that establishes the CMMC program, its levels and assessment types
- Department of War: CMMC Phase II suspension announcement — July 2026 announcement suspending Phase 2 requirements