While there are differing opinions about how the Pentagon could improve the Cybersecurity Maturity Model Certification program, most organizations agree the Defense Department’s inconsistent and unclear process for marking controlled unclassified information continues to be a critical problem driving CMMC costs and confusion.
In comments filed to the CMMC Reform Task Force, multiple industry groups highlighted CUI identification and marking as one of the main cost drivers of the cyber evaluation program. The Pentagon has paused CMMC third-party assessment requirements to address cost and compliance concerns, especially for small businesses.
CUI is sensitive government data that doesn’t meet strict criteria for national security classification, but still requires special protection and handling controls under federal laws or policies.
CMMC is intended to verify whether contractors are protecting CUI in line with federal cyber standards.
But industry organizations say both DoD and prime contractors often improperly mark CUI or apply blanket CMMC requirements across subcontractors, regardless of whether companies will handle CUI. They say that in turn requires companies, including smaller firms, to unnecessarily comply with costlier CMMC standards.
The Office of Advocacy, an independent organization within the Small Business Administration, highlighted CUI uncertainty as the “most frequently cited concern” for small businesses when it comes to CMMC.
“This uncertainty has downstream consequences,” Advocacy wrote in reply to the CMMC Reform Task Force’s request for information. “When a contractor cannot confidently determine what information is CUI, they will generally err on the side of including all of it into their compliance boundary. Small businesses expressed numerous times that CUI is being overmarked, inconsistently marked, or improperly flowed down through the supply chain.”
The office said DoD in some cases has even treated publicly available information as CUI.
Likewise, the National Defense Industrial Association said its members have identified “multiple instances where inconsistencies, ambiguities and inaccuracies” with CUI marking has led to “confusion, increased costs, and decreased security for all parties.”
“Without addressing the underlying CUI program, the current inconsistent marking process will continue to lead to increased costs and burdens on industry and degraded security for department information,” NDIA wrote in its letter to the CMMC Reform Task Force.
The Professional Services Council, in its reply to the RFI, said inconsistent CUI marking is “creating confusion about what requires protection.” PSC said CMMC and other requirements have been applied inconsistently across DoD contracts so far, with “significant variation” in how different contracting officers decide to require certifications.
“For prime contractors and their suppliers, this creates uncertainty, which can be mitigated through standardized guidance, better training, and more consistent acquisition practice,” PSC wrote. “The solution is to improve execution, not to postpone or weaken the requirements.”
A longstanding problem
The CUI problem isn’t new. Multiple audits, including a DoD Inspector General report earlier this year, have flagged pervasive issues with DoD failing to properly mark CUI data.
The governmentwide CUI program was created in 2010 to standardize and simplify how the government labels and protects sensitive information that isn’t classified. The National Archives and Records Administration lists more than 100 types of CUI, ranging from defense controlled technical information to archaeological resources and federal taxpayer information.
But the wide range of categories and continued ambiguity about how to define CUI at the contractual level has led to DoD officials overmarking information in some cases, while also failing to mark critical data in others.
“There have been efforts at the department to put out simplified instructions, simplified technical manuals, and training within the government, but it’s still a problem,” Sandeep Kathuria, a partner and government contracts attorney with Saul Ewing, told Federal News Network.
DoD officials have been known to include default CUI markings in the headers or footers of their emails, regardless of whether a particular message carries such data, according to Alex Major, partner and government contracts attorney at McCarter & English.
“They’re not necessarily willing or able to tie it to a particular law or regulation under which that data is supposed to be protected, so they put it under this overarching umbrella,” Major said.
Michael Lowell, partner and chairman of the Global Regulatory Enforcement Group at Reed Smith, said the issue is further complicated by the fact that companies can create CUI on behalf of the government when executing a contract, especially for sensitive DoD technology.
“That can create significant uncertainty under CMMC,” Lowell said. “A contractor may receive little or no marked CUI from DoD but create information during contract performance that qualifies as CUI. If the contract does not clearly tell the contractor what types of information are expected to be CUI, the contractor may have to make difficult judgments about its own engineering data, technical reports, drawings or other work product.”
Meanwhile, contractors at the top of the defense supply chain are responsible for figuring out whether subcontractors will have to handle CUI. But Kate Growley, a partner at Crowell & Moring, pointed out that defense acquisition rules direct those contractors to consult with their DoD contracting officer when they’re unsure about CUI scope.
“CMMC follows the data,” Growley said. “If CUI is being over- or under-scoped, so will the scope of CMMC. Many contractors have historically taken a conservative approach to scoping their own CUI, erring on the side of over-scoping, sometimes because their contracts do not clearly identify what information is or is not CUI.”
‘Warrants immediate attention’
SBA’s Office of Advocacy told the CMMC Reform Task Force that the CUI issue “warrants focused, immediate attention.”
“Advocacy recommends that the [DoD] establish a clear, government-wide process requiring the department to identify the anticipated CUI categories, markings, data flows, systems, deliverables, and other activities involving CUI before imposing CMMC requirements on a contractor,” it wrote. “No small business should have to build and price expensive cybersecurity architecture around an undefined category of information.”
The Alliance for Digital Innovation, a coalition of commercial technology companies, also recommended DoD ensure prime contractors aren’t unnecessarily requiring subcontractors to achieve CMMC “Level 2” third-party certification requirements.
“In practice, prime contractors impose blanket Level 2 flow-downs on every subcontractor, including machine shops producing commercially available products that never touch CUI, because primes lack confidence in scoping determinations and default to over-inclusion to avoid audit liability,” ADI told the reform task force. “Addressing this interpretation and enforcement gap corrects the misapplication of an existing rule without creating new regulatory burden, and shifts accountability from small manufacturers absorbing unnecessary compliance costs to primes performing the scoping diligence the framework already requires.”
PSC recommended DoD conduct a “periodic review of legacy CUI markings and confirm that contractors are not obligated to protect material that was never properly designated by an authorized designating authority.”
Other groups are pushing DoD to take a more nuanced approach to where and when CMMC requirements apply.
Associated Builders and Contractors (ABC), in a letter to the task force, pointed to small and specialized subcontracts “that may need limited CUI access but do not maintain their own certified environments.”
The trade group recommended a tiered model that distinguishes between “bid-only access to non-CUI, view-only access to CUI within a certified prime-controlled or hosted enclave and subcontractor storage, processing or transmission of CUI in its own systems.”
“The DOD should specify the corresponding contractual, authorization, training, identity, access-control, incident and evidence requirements so that CUI remains protected without creating unnecessary barriers to competition and participation,” ABC wrote.
The window to respond to the CMMC Reform Task Force’s RFI closed last week. The group is expected to take roughly one more month to complete its work, before making recommendations to the DoD Office of the Chief Information Officer.
Major said fine-tuning how CUI is defined in contracts could be critical for DoD’s goal of containing CMMC-related costs, as businesses would be able to more accurately tailor what IT systems and users should be part of an assessment.
Meanwhile, he said a long-awaited, governmentwide CUI acquisition rule proposed earlier this year could also go a long way toward resolving some of the ambiguities.
“It at least allows the conversation to start, ‘Wait, what are you expecting to send to me? How are you expecting to send it to me?’ And then allows contractors to ask the question, ‘What type of CUI are you sending me?’ That is something we’ve been trying to encourage clients to do for quite some time now,” Major said.
Kathuria argued the Trump administration should consider overhauling the current CUI program through a new executive order, with an eye toward consolidating the dozens of CUI categories that exist today.
“It’s too complex,” Kathuria said. “If you get it to a manageable number, people can actually apply it consistently.”
Whatever the long-term solution is, Lowell said the most important thing DoD can do as part of its sweeping CMMC reform is provide CUI “clarity” at the contract level.
“The broader point is that CMMC works best when the government clearly defines the information that needs protection,” he said. “When the CUI boundary is unclear, contractors tend to protect more information, systems and people than may actually be necessary. That increases the cost and complexity of CMMC – particularly for small businesses – without necessarily producing a corresponding cybersecurity benefit.”
Copyright
© 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.
