TECHNICAL NOTES · COMPLIANCE

CMMC Phase 2 is suspended. Your CUI obligations aren't.

On 13 July 2026 the Department of Defense suspended Phase 2 of the Cybersecurity Maturity Model Certification programme, four months before it was due to start. It is easy to read that as a pause on CUI security. It isn't — and the difference matters for how engineering teams use AI.

What changed

  • 13 July 2026 — two DoD memoranda suspended CMMC Phase 2, which had been due on 10 November 2026, together with all later phases. Programme managers can designate only Level 1 (Self) or Level 2 (Self); third-party (C3PAO) Level 2 and DIBCAC Level 3 assessments are off the table. Reported reasons included limited assessor capacity and the cost to small and mid-sized suppliers.
  • 14 August — the public request for information on the programme's future closed.
  • 3 September — a Defense Pricing, Contracting and Acquisition Policy class deviation made the suspension binding on contracting officers, directing them to remove third-party assessment requirements from contracts.
  • Around 11 September — the CMMC reform task force's 60-day report reached the DoD CIO. At the time of writing it has not been published, and no restart date has been announced.

What did not change

The suspension removed an assessment regime. It did not remove the security requirements the assessments were meant to confirm:

  • DFARS 252.204-7012 still requires adequate security for covered defense information and incident reporting within 72 hours.
  • NIST SP 800-171 (Revision 2) is still the control baseline, with self-assessment scores in SPRS under DFARS 252.204-7019 and -7020.
  • CMMC Phase 1, in force since 10 November 2025, still applies: Level 1 and Level 2 self-assessments and annual affirmations where a contract requires them.
  • ITAR and EAR are unaffected. Export-controlled technical data has its own rules, independent of CMMC.

Self-attestation arguably raises the stakes: an affirmation that turns out to be inaccurate is the contractor's own statement, not an assessor's.

Where AI tools fit

For engineering teams the practical question is where a model is allowed to see controlled data. DFARS 252.204-7012 requires that a cloud service used to store, process or transmit covered defense information meet security requirements equivalent to the FedRAMP Moderate baseline. Pasting CUI into a general consumer AI service is therefore not a CMMC question at all — it was already a 7012 problem before Phase 2 existed, and it still is.

The workable pattern hasn't changed either:

  • Classify first: public, proprietary, CUI or export-controlled.
  • Keep controlled data on infrastructure inside your boundary — local, on-premises or air-gapped — with the model running there too.
  • Use cloud AI only for work that is public or cleared for it.

AETHER is built around that split. AETHER Cloud is for public and non-sensitive work; for CUI and export-controlled programmes the engines run locally, on-premises or air-gapped, so the data and the model stay inside the customer's boundary. The broader case is in Sovereign AI for aerospace and defense.

This note summarises public reporting and is not legal advice; check your contracts and the current DoD guidance for your obligations.

Published · 14 September 2026 · All technical notes