This article reflects publicly available guidance as of July 2026 and is intended for informational purposes, not legal advice. Contract-specific questions should be discussed with qualified legal counsel. The headline in the ecosystem the past 2 weeks has been that CMMC is “suspended”. If you are like me, your group chat and voicemail lit up,...
If you handle defense work, you already know that ITAR (International Traffic in Arms Regulations) and CUI (Controlled Unclassified Information) often come up in the same conversation. They overlap, but they are not the same thing. This post explains when ITAR-controlled information must also be handled as CUI and when it stands alone under export control. Oh yeah — I...
The purpose of the CMMC program is to verify that contractors have proper safeguards for Controlled Unclassified Information (CUI) and Federal Contract Information (FCI) by moving from self-assessment to third-party or government assessments. This marks a significant change for DoD contractors, aimed at increasing accountability and ensuring the implementation of cybersecurity controls across the defense...
