To this point, the DoD’s acquisition workforce has not been able to fulfill their obligation to correctly label information for contractors to handle properly. The DoD is aware of this problem, and they are working to train the acquisition workforce to better handle the labeling of sensitive information. But here are 2 things to consider. First, your company can create Controlled Unclassified Information, the kind the DoD wants to protect with CMMC Level 3 controls. For some companies, they may end up creating more CUI than the DoD gives them! This means that regardless of what the DoD gives you or labels for you, you have a responsibility to understand what CUI is and handle it properly. Second thing to consider, as the CMMC ecosystem matures, there will be a greater capacity to audit the private contractor information systems that handle DoD information. Right now, the CUI registry is at 105 categories of CUI, but with the growth of CMMC, new systems and companies will be brought in to the fold. It will not be surprising if the definition of what CUI is increases over time.

Further reading from an authoritative source:



Founded in 2000 by a retired Air Force Chief Master Sergeant, TechSage Solutions has had an eye for cyber security since it’s beginning. As the world of cyber security compliance standards has evolved over the past 20 years, CEO John Hill has always been mindful of what today’s regulatory environment calls for and what future needs will be. CMMC has been on TechSage Solutions radar for a while now because several of TechSage’s clients are DoD contractors and together, we’ve had to deal with NIST SP 800-171 requirements. For TechSage Solutions, CMMC is just another development in a world we’re already comfortable in. If your MSP has not discussed the current and future implications of CMMC for your organization, the time is now to consider what this lack or preparation will truly cost you. Industry experts have made it clear that organizations who are on the front of CMMC adoption will carry a competitive advantage in a highly competitive DoD contractor industry, so don’t wait to determine your organization’s plan. For further resources, please visit: or call 210-582-5814 and request the free guide for business owners and executives titled: “Planning Your CMMC Journey: 5 Questions You Should Be Asking”.”