CMMC Questions From the Field

CMMC questions from the field · Answers sourced from 32 CFR 170, 32 CFR 2002, DFARS and DoD guidance · Updated September 2026

These are the questions defense suppliers actually ask once CMMC stops being a slide deck and becomes a contract clause: what happens when a Conditional status runs out, what to do with an unmarked document from the program office, whether you may stamp your own drawings CUI, whether everything under a DoD contract is CUI, and how to keep a machine shop or a design partner out of your Level 2 scope without breaking the rules. Each answer below quotes the clause it rests on and links to the primary source, so you can hand it to your contracting officer, your prime or your assessor.

The questions

• My Conditional CMMC status and 180-day POA&M window are ending and I am not at 110. What happens, and what should I do?
  Automatic expiry, “standard contractual remedies,” ineligibility for new Level 2 awards until a new status, and why finalising a failed closeout is worse than letting it lapse. 32 CFR 170.16, 170.21, 170.22; DFARS 252.204-7021; DoD FAQ C-Q8.
• We received a document from DoD or a prime that looks like CUI but is not marked. What do we do?
  Protect it, stop onward distribution, ask the contracting officer in writing, log the answer. 32 CFR 2002.20(a)(7) and (m); DoDI 5200.48 para 5.3.a; NARA CUI FAQ.
• We create documents under the contract. Can we mark them CUI?
  You do not designate, but you must mark derivative CUI when the contract says so; what the designation block looks like; the four things a contractor cannot do. 32 CFR 2002.20(a)(4), (d)(1); DoDI 5200.48 para 3.6.a; DFARS 252.204-7012 CTI.
• Is only marked information CUI, or is everything we do for the government CUI?
  Neither: CUI is defined by category and origin, not by the banner; FCI and your own business information are different buckets. 32 CFR 2002.4(h), 2002.12; FAR 52.204-21; 32 CFR 170.23.
• How do we share work with vendors that are not CMMC Level 2 by redacting or segmenting the CUI?
  Option A (flow it down) versus Option B (a derivative with zero CUI), the golden rule of redaction, aggregation checks, VDI and separation patterns, and the paperwork for each tier. 32 CFR 170.23, 170.19; DFARS 252.204-7012(m); 32 CFR 2002.18; DCSA CUI FAQ.

How these answers are built

Every page follows the same discipline. The direct answer comes first and can be quoted on its own. The reasoning cites the regulation by paragraph: 32 CFR Part 170 for the CMMC Program, 32 CFR Part 2002 for the CUI Program, DFARS 252.204-7012, 7019, 7020 and 7021 for the contract clauses, DoD Instruction 5200.48 for DoD’s CUI implementation, and the DoD CIO CMMC FAQ, the CMMC Level 2 Scoping Guide, NARA and DCSA FAQs for official interpretation. Where the source is secondary or the position is a practitioner’s judgment, the page says so. Nothing here is legal advice, and ITSECOPS is not affiliated with the Department of Defense.

Where CMMC stands in September 2026

On 13 July 2026 the Department announced the suspension of CMMC Phase II while stating that “All Phase I self-assessment requirements remain firmly in place,” and that contractors “remain contractually obligated to safeguard covered defense information in accordance with DFARS clause 252.204-7012.” The CUI rules on this page predate CMMC and are unaffected by the suspension. The Conditional status mechanics apply to Level 2 (Self) assessments that remain in Phase I. For what the pause does and does not change, see CMMC Phase 2 suspended: what still applies and CMMC and the False Claims Act.

Related tools and guides

• SPRS score calculator: all 110 requirements with official DoD weights, so you know exactly which items may sit on a POA&M.
• CMMC cost and roadmap planner: enclave versus enterprise scoping, cloud tiering for CUI Basic, ITAR and EAR.
• CMMC compliance guide: levels, timelines and what each assessment involves.
• CMMC for suppliers outside the United States: the questions non-US subcontractors ask primes.
• Compliance policy pack: the written procedures (CUI handling, marking, redaction, media) that turn these answers into evidence.

FAQ

Where do these CMMC answers come from?

From the primary sources: 32 CFR Part 170, 32 CFR Part 2002, the DFARS 252.204-70xx clauses, DoDI 5200.48, the DoD CIO CMMC FAQ and Scoping Guides, and NARA and DCSA CUI FAQs. Each page lists the paragraph it relies on with a link.

Are these answers legal advice?

No. They are practitioner explanations of published regulations and guidance. Contract-specific decisions belong with your contracting officer, and legal questions with counsel.

Can I ask a CMMC question that is not covered here?

Yes. Book a session and bring the contract clause, the document or the vendor scenario. If the question is one other suppliers share, the answer may become the next page in this series.