CUI Enclave for Defense Suppliers While CMMC Rules Settle

Challenge

• On July 13, 2026, the Department of War (DoW) suspended CMMC Phase II, which had been scheduled for November 10, 2026. No restart date has been announced.
• The suspension did not remove the underlying obligations. DFARS 252.204-7012, NIST SP 800-171, incident reporting and Phase I self assessments posted in SPRS all remain in force.
• CUI is spread across email, file shares, laptops and engineering tools. That makes the assessment boundary, and the cost of compliance, far larger than it needs to be.
• An inaccurate SPRS score or attestation can create False Claims Act exposure, whatever happens to the CMMC timeline.

Approach

• Map where CUI is created, stored, processed and transmitted, and who touches it.
• Define a small enclave boundary that contains CUI, the people who need it and the tools they use.
• Build the enclave on hardened identity, phishing resistant multifactor authentication, managed endpoints, encrypted storage, logging and backup.
• Map the enclave to all 110 NIST SP 800-171 Revision 2 requirements. Document the System Security Plan, and track gaps in a plan of action and milestones.
• Validate the configuration in the Norseman integration lab, then deploy it and train users.
• Produce evidence packages that support an accurate self assessment now and a third party assessment later.

Typical Outcomes

• A much smaller compliance boundary, with a lower cost to secure and to assess
• An SPRS score backed by documented evidence
• A defensible position if CMMC Phase II restarts with short notice
• Clear separation between CUI work and the rest of the business

Cost of Waiting

Phase II is paused, not cancelled, and DoW's own task force has floated restarting it for a narrower group of contractors. Suppliers who wait may find themselves in a short window with limited assessor availability, while carrying the same obligations and enforcement risk they carry today.

Procurement Paths

• GSA MAS for assessment, engineering and integration services
• NASA SEWP VI (Category A) for security hardware and software
• DoD ESI for Palo Alto Networks and Elastic components where eligible
• Commercial: direct purchase and financing

Compare vehicles and ordering steps on How to buy.

Technology Categories

• Identity and access management
• Phishing resistant authentication
• Endpoint protection
• Government cloud collaboration
• Data loss prevention
• Logging and SIEM
• Backup and recovery
• Governance, risk and compliance tooling