Sign up with Google
Sign in with Zoho
And the ground keeps moving. Phase 1 has been in force since November 2025, the Department of War paused Phase 2 in July 2026, and a reform task force is still sorting out what comes next. So do you ease off? No. Here’s how to keep CMMC compliance running without burning your people out.
Why a Paused Phase 2 Doesn’t Mean You Can Relax
Phase 2 would have made a third-party C3PAO assessment a condition of award on many CUI contracts. That’s on hold. Phase 1 isn’t.Whoever signs that affirmation carries the risk. DOJ has been using the False Claims Act against contractors who overstated their cybersecurity scores, and those settlements are not rare anymore.
Your prime can also flow requirements down to you no matter what Washington announces. And the pause is a policy memo, not a repeal, so it can be reversed fast. As of this writing the task force report hasn’t been made public, so check the DoW CIO site before you plan around any date.
Shrink Your Scope First, It’s the Cheapest Win
Scope is where IT teams drown. Every laptop, every shared drive, every phone that touches CUI is something somebody has to document, monitor and patch. Fewer systems in scope means less work. Simple.
A CUI enclave, basically a locked-down environment where CUI lives and nowhere else, is one way to do it. Lots of aerospace, maritime and technology subs go this route. But be careful with the cloud assumption. Moving CUI to cloud storage doesn’t automatically pull your endpoints out of scope, because if a laptop processes CUI it’s in scope.
Full stop. Cloud providers holding CUI also need to meet FedRAMP Moderate or an equivalent, and ITAR data has its own storage headaches, commercial Microsoft 365 won’t cut it there.
Unmanaged BYOD is the quiet scope-blower. One employee forwards a CUI email to a personal phone and suddenly your boundary is bigger than you thought.
Find Out Where Your CUI Really Is
Read your contracts for CUI references and handling requirements. Government marking is inconsistent, which is annoying, so when it’s unclear, ask your contracting officer instead of guessing. Guessing wrong either way costs you.
Make CMMC Requirements a Routine, Not a Yearly Scramble
Annual panic is the thing that kills IT teams. Compliance that lives in a binder falls apart, assessors want proof your controls actually run, not just that a policy exists. So spread the load. Automate evidence collection where you can, centralize logging, and put small monthly tasks on a calendar. Access reviews, vulnerability scans, patch checks. Boring, small, steady.
Keep your System Security Plan and POA&M current too. A POA&M isn’t a free pass, and an open item that sits for a year tells an assessor, or a whistleblower, something you don’t want said. Continuous monitoring through a 24/7 SOC makes this much lighter, since someone besides your two-person IT team is watching alerts at 2 a.m.
Know When to Bring in Outside Help
You don’t have to build everything in-house. A Registered Provider Organization can run gap assessments, build your roadmap and do mock audits. Managed SOC and virtual compliance management take the daily grind off your team while your people keep ownership of decisions.
Co-managed models usually work best. It isn’t just contractors either. Maritime operators dealing with the Coast Guard cyber rule, state and local agencies, and even C3PAOs going through their own accreditation lean on managed services for the same reason. Nobody has a spare headcount.
Get Leadership Behind It, Honestly
Owners and CEOs often see this as an IT cost. It isn’t. It’s contract eligibility and legal exposure.Set an AI policy too. Staff pasting CUI into public chatbots is a very real, very quiet problem. Put it in those terms. Show the person signing the affirmation what’s actually behind their signature, and give them visibility into real status, not a green dashboard that hides gaps.
Frequently Asked Questions
Is CMMC certification still required with Phase 2 paused?
Phase 1 self-assessment requirements are in force. Third-party C3PAO requirements for Level 2 are on hold pending the reform review, but NIST SP 800-171 obligations haven’t gone anywhere.
Who needs to comply?
Primes and subcontractors handling FCI (Level 1, 17 practices) or CUI (Level 2, 110 practices aligned to NIST SP 800-171).
Can we use AI tools with CUI?
Only if the tool and its hosting meet your CUI handling requirements. When unsure, keep CUI out of it.
Do we still need a C3PAO?
Not required by the paused phase right now, but your prime might ask, and requirements could return.
Final Thoughts
The honest answer is that CMMC compliance gets lighter when you shrink scope, automate the boring evidence work, bring in help where it counts, and get leadership to treat it as business risk. It doesn’t get lighter by waiting. The rules may shift again, but the underlying controls and the legal exposure won’t. Build it into your routine now and your IT team survives whatever the task force decides.
