Controlled Unclassified Information (CUI) stays protected after it leaves a network when the access control is bound to the data object rather than to the boundary. A file emailed to a subcontractor, uploaded to a partner portal or copied to a laptop has left every control the sending organization operates, unless the object itself requires a policy decision before it opens. Contractual obligations to safeguard CUI continue regardless of where the file sits, which is why boundary-shaped controls and contract-shaped obligations diverge at exactly the point where most defense supply chains actually exchange data.
What CUI is and who is obligated to protect it
Controlled Unclassified Information is unclassified information that law, regulation or government-wide policy requires be safeguarded or subjected to dissemination controls. The executive branch CUI program is established in 32 CFR Part 2002, and the categories are published in the National Archives CUI Registry.
For defense contracts, the operative obligation is DFARS 252.204-7012, which requires a contractor to "provide adequate security on all covered contractor information systems" holding covered defense information, and to report cyber incidents within 72 hours of discovery through dibnet.dod.mil. Cloud services used to store covered defense information must meet security requirements equivalent to the FedRAMP Moderate baseline.
The obligation follows the information, not the network. A contractor does not discharge DFARS 252.204-7012 by holding CUI inside an accredited enclave and then sending it somewhere else.
What remains in force after the CMMC Phase 2 suspension
On 13 July 2026, the Department of War issued two memoranda suspending Phase 2 of the Cybersecurity Maturity Model Certification programme: one from the Chief Information Officer, titled "Removing Barriers to Defense Industrial Base Expansion," and an implementing memorandum from the Under Secretary of Defense for Acquisition and Sustainment. The suspension removed the requirement for independent third-party assessment by a CMMC Third Party Assessor Organization (C3PAO) as a condition of award, which had been scheduled to begin 10 November 2026, along with Phase 3 government-led Level 3 assessments. A CMMC Reform Task Force was launched with a 60-day review; responses to its request for information were due 14 August 2026.
What was suspended was the assessment mechanism. What was not suspended is the obligation.
| Requirement | Status after 13 July 2026 |
|---|---|
| DFARS 252.204-7012 safeguarding and 72-hour incident reporting | In force |
| NIST SP 800-171 Rev 2, 110 security requirements across 14 families | In force |
| Phase 1 self-assessment (Level 1 and Level 2 self-assessment) | In force |
| SPRS summary level score posting and maintenance | In force |
| Subcontractor flow-down under DFARS 252.204-7012 | In force |
| DFARS 252.204-7020 assessment currency for subcontract award | In force |
| Phase 2 C3PAO third-party certification as award condition | Suspended pending reform review |
| Phase 3 government-led Level 3 assessment | Suspended pending reform review |
The durable lesson is not the pause. It is that the assessment mechanism proved negotiable and the underlying obligation did not. Architecture built to satisfy an assessment date is exposed when the date moves. Architecture built to satisfy the safeguarding requirement is unaffected by which body performs the check. Prior analysis of that distinction sits in CMMC Level 2 compliance through data-centric security.
Where boundary controls stop working: subcontractor flow-down
DFARS 252.204-7012 paragraph (m) requires the contractor to include the clause, including paragraph (m) itself, in subcontracts for operationally critical support or where subcontract performance involves covered defense information. The clause propagates down the tier structure by its own text.
DFARS 252.204-7020 paragraph (g)(2) adds a gate: a contractor shall not award a subcontract subject to NIST SP 800-171 implementation unless the subcontractor has completed, within the last three years, at least a Basic NIST SP 800-171 DoD Assessment. The Basic Assessment is a contractor self-assessment yielding Low confidence. Medium and High assessments are government-conducted and yield correspondingly higher confidence.
Flow-down is where boundary controls fail, for a structural reason. A prime can accredit its own enclave. It cannot accredit a fourth-tier machine shop's file server, and the clause does not give it inspection rights sufficient to try. What the prime can control is the object it sends. If the CUI file requires a live policy decision to open, the sub's network posture stops being the prime's exposure. If it does not, the prime has transferred its obligation to a party it cannot audit. Related patterns appear in DIB cyber compliance audit failure patterns.
How zero trust protects CUI shared externally
Zero trust protects externally shared CUI by moving the authorization decision from the network boundary to the moment of access on the object. Three properties do the work.
The policy travels with the object. Classification, CUI category and handling restrictions are bound to the ciphertext, so a copy in a partner's Dropbox carries the same restrictions as the original.
The decision is evaluated at decrypt. A policy enforcement point (PEP) that acts at decrypt time enforces regardless of which service is in the path. Gateways, portals and mail relays become transport rather than control points.
The decision is attribute-based. A policy decision point (PDP) evaluating attribute-based access control (ABAC) can require organization, contract, clearance, device posture and geography together, which is the shape of a real CUI release rule. Role-based access control alone cannot express "employees of this subcontractor, on managed devices, inside the United States, for this contract only."
Fail-closed default is the property that makes this contractually meaningful. If the decision service cannot be reached, the object does not open, and revocation on contract termination propagates to deny rather than depending on a partner deleting files.
Limited dissemination controls as machine-enforceable policy
CUI limited dissemination controls are the existing, government-defined vocabulary for who may receive a given piece of CUI, and they map directly onto attribute-based policy. Only the designating agency may apply them.
| Control marking | Restriction | Attribute expression |
|---|---|---|
| NOFORN | No dissemination to foreign nationals or organizations | Nationality attribute of the requesting subject |
| FED ONLY | Federal executive branch employees and armed forces only | Employer type attribute |
| FEDCON | Federal employees, armed forces and contractors under United States contract | Employer type plus contract attribute |
| NOCON | No contractor access; state, local and tribal permitted | Employer type attribute |
| DL ONLY | Only parties on an accompanying dissemination list | Explicit subject list |
| REL TO [USA, LIST] | Release approved to named countries or organizations | Nationality plus release list |
| DISPLAY ONLY [USA, LIST] | Foreign recipients may view but not retain | Nationality plus a no-retention enforcement mode |
Treating these markings as attributes rather than as text on a cover page is what turns a marking scheme into an enforceable control. The marking already exists in the contract. The gap is that most systems render it and do not evaluate it.
What object-level enforcement of CUI does not do
Object-level enforcement does not satisfy NIST SP 800-171 by itself. The 110 requirements span 14 families including physical protection, personnel security, awareness and training, and incident response. Cryptographic enforcement addresses access control, audit and accountability, media protection and system and communications protection. It does not conduct background checks.
Object-level enforcement does not prevent an authorized recipient from retyping the content into an unprotected document. Rights management and endpoint data loss prevention reduce that surface and neither eliminates it.
Object-level enforcement does not remove the SPRS score obligation or the self-assessment. Those are procedural requirements about documented state, and no product satisfies a procedural requirement on a contractor's behalf.
Object-level enforcement also does not resolve classified handling. CUI is unclassified, and moving material between classification levels remains governed by cross-domain solution accreditation.
How Lattix enforces CUI policy off-network
Lattix binds policy to the CUI object and enforces it at decrypt. The PDP evaluates ABAC across subject, device, environment and geography, purpose of use, network posture, risk, and data-object attributes, and returns a signed, short-lived decision carrying allow or deny, the reasons, the policy version hash, and the object identifier. Defaults are fail-closed and revocation propagates to deny, so a terminated subcontract closes access to distributed copies. Content identifiers and Merkle-tree lineage make access history queryable, which supplies evidence against the audit and accountability requirements rather than an assertion that controls exist. The architecture behind this is set out in Data-Centric Security for Defense: A Reference Architecture.
Frequently asked questions
How does zero trust protect CUI shared externally?
Zero trust protects externally shared CUI by binding the access policy to the data object and evaluating it at decrypt time rather than at a network boundary. A copy held by a partner still requires a live policy decision, evaluated against subject, device, contract and geography attributes. Defaults are fail-closed, so an unreachable decision service or a revoked contract results in denial rather than access.
How can access controls be enforced after data leaves the network?
Access controls survive the network boundary when the control is cryptographic and bound to the object. The object is encrypted, the policy reference is bound to the ciphertext, and a policy enforcement point requires a decision before releasing cleartext. Boundary controls including firewalls, secure gateways and network data loss prevention cannot enforce anything on a file already delivered to a third party.
What are the requirements for secure sharing between agencies and contractors?
For defense work, DFARS 252.204-7012 requires adequate security on systems holding covered defense information, 72-hour incident reporting, FedRAMP Moderate equivalent cloud services, and flow-down to subcontractors under paragraph (m). NIST SP 800-171 Rev 2 supplies the 110 security requirements. DFARS 252.204-7020 requires a subcontractor to hold a Basic assessment no more than three years old before award.
Is CMMC still required after the Phase 2 suspension?
Phase 1 CMMC self-assessment requirements remain in effect. The Department of War suspended Phase 2 third-party C3PAO certification as an award condition and Phase 3 government-led Level 3 assessments on 13 July 2026, pending a reform task force review. DFARS 252.204-7012, NIST SP 800-171 Rev 2 implementation, SPRS score posting and subcontractor flow-down were not suspended.
Which NIST SP 800-171 revision applies to DFARS contracts?
NIST SP 800-171 Revision 2 applies to DFARS 252.204-7012 obligations, comprising 110 security requirements across 14 families. Department of War guidance following the July 2026 CMMC Phase 2 suspension confirmed Rev 2 compliance continues to be enforced through self-assessments and selected government-led assessments. Revision 3 exists as a NIST publication but is not the revision named in the operative DFARS obligation.
What does DFARS 252.204-7012 require of subcontractors?
DFARS 252.204-7012 paragraph (m) requires the contractor to include the clause, including paragraph (m), in subcontracts for operationally critical support or where performance involves covered defense information. The clause therefore propagates through every tier that touches the data. DFARS 252.204-7020 paragraph (g)(2) separately bars award unless the subcontractor completed at least a Basic NIST SP 800-171 DoD Assessment within three years.