The compliance path changed. The responsibility to protect CUI has not.
As CMMC requirements evolve, organizations handling Controlled Unclassified Information (CUI) remain responsible for implementing applicable NIST SP 800-171 requirements and completing required self-assessments and affirmations.
Exostar brings together the latest updates, expert guidance, and actionable resources to clarify what has changed, what remains in effect, and how to move forward with confidence.
On-Demand Executive Briefing
Protecting CUI After the CMMC Update
Watch Exostar’s executive leadership team explain what the update means for organizations handling CUI, clarify today’s cybersecurity responsibilities, and discuss where businesses should focus now.
Watch Now
Expert Insight
Go beyond the headlines to explore why the latest CMMC changes don’t alter the real objective: protecting CUI and building a stronger cybersecurity program.
Read the Article
Editorial Insight
Explore how rising enforcement pressure is redefining risk—and why a defensible approach to protecting sensitive data matters for defense contractors.
Read the Article
Key Takeaways
Protecting CUI doesn’t begin or end with a single assessment. It requires an ongoing, disciplined cybersecurity program that supports your contractual obligations today—and adapts as requirements evolve.
How do the latest CMMC changes affect your organization? Explore the FAQs below for clear guidance on current requirements or contact us using the form below.
Not exactly.
The Department of War (DoW) suspended the planned expansion of CMMC Phase II third-party assessment requirements while it conducts a 60-day program review.
What did not change is your responsibility to protect Controlled Unclassified Information (CUI), implement the applicable NIST SP 800-171 Rev. 2 security requirements, and complete any required CMMC self-assessments and affirmations when applicable under your contracts.
The DoW paused the planned implementation of CMMC Phase II for 60 days while it reviews the program. The pause affects the planned expansion of mandatory third-party assessments, not the underlying responsibility to protect CUI.
Your responsibility to protect CUI, implement NIST SP 800-171 Rev. 2 where required, maintain documentation, and complete applicable self-assessments remains unchanged.
No. CMMC has not been cancelled. Phase II implementation has been paused while the program is reviewed. Phase I requirements remain in effect.
The DoW has described this as a temporary review. Organizations should continue meeting current contractual requirements while monitoring future guidance.
Yes. The DoW issued a Request for Information (RFI), and organizations may provide feedback using the official submission process. Comments may be submitted until 12:00 PM ET on August 14, 2026.
Yes.
If your organization stores, processes, or transmits CUI under DFARS 252.204-7012, your contractual obligation to protect that information has not changed.
The recent announcement affects the planned rollout of third-party assessments, not the requirement to safeguard CUI.
Yes. Organizations subject to DFARS 252.204-7012 must continue implementing the applicable NIST SP 800-171 Rev. 2 security requirements. Those requirements remain the foundation for protecting CUI regardless of future CMMC program decisions.
If your contract requires a CMMC Level 1 Self or Level 2 Self assessment, yes.
Organizations should complete the required self-assessment, document the results, maintain supporting evidence, and submit the required affirmation to SPRS when applicable.
Yes. Your SPRS submission should accurately reflect your cybersecurity posture and be supported by objective evidence.
A self-assessment evaluates your implementation of NIST SP 800-171, identifies gaps, and documents objective evidence.
A self-affirmation is the official statement submitted through SPRS (when required) confirming your organization meets the applicable requirements.
Think of the self-assessment as the work that supports a defensible self-affirmation.
The self-assessment is typically performed by your cybersecurity, IT, or compliance team, sometimes with assistance from a trusted advisor.
The affirmation is submitted by an authorized company official, such as a CEO, President, Owner, Corporate Officer, or other designated representative.
The assessment documents the work. The affirmation is the organization’s official declaration that the work is complete and supported by evidence.
Maintain documentation demonstrating how you protect CUI and implement NIST SP 800-171.
Typical documentation includes:
No. Continue implementing controls, documenting your environment, and preparing for self-assessment. Don’t pause your readiness efforts.
No. Your investment reduces cyber risk, supports contractual obligations, and prepares your organization for future verification.
If you have already engaged a C3PAO, continue according to your plans. If not, consider waiting until the DoW review concludes before making that investment.
We don’t recommend waiting.
Your obligations begin when the applicable contractual clauses are included in your contracts, not when future third-party assessment decisions are announced. Continuing to strengthen your cybersecurity posture today reduces risk and prepares you for whatever comes next.
Exostar helps organizations protect CUI by securing where it is stored, processed, and transmitted.
We also help customers:
Yes. Organizations still need to organize documentation, manage evidence, protect CUI, and support required self-assessments and affirmations. The recent announcement changed the certification path, not the underlying cybersecurity responsibilities.
Reducing CUI scope means limiting where CUI is stored by moving it into a secure managed environment.
Fewer systems containing CUI can reduce operational complexity, security risk, documentation, evidence collection, and ongoing compliance effort.
No. Exostar provides a secure managed collaboration environment with inherited and shared security capabilities. Your organization remains responsible for its security program, policies, personnel, and many NIST SP 800-171 controls.
Because protecting CUI is still a contractual requirement.
Strengthening your cybersecurity posture helps reduce cyber risk, protect customer trust, and prepare your organization for future Department of War requirements.
Focus on:
Connect with Exostar to discuss your organization’s requirements and determine the right path forward.
