CMMC review: DoD’s inconsistent CUI marking continues to plague program

Key Points:

• Industry groups and the SBA's Office of Advocacy highlight inconsistent and unclear marking of Controlled Unclassified Information (CUI) by the Department of Defense (DoD) as a major driver of cost and confusion in the Cybersecurity Maturity Model Certification (CMMC) program.
• Overmarking or improper marking of CUI leads contractors, especially small businesses, to apply unnecessarily stringent and costly cybersecurity requirements, as they err on the side of caution due to lack of clear guidance.
• The DoD has paused third-party CMMC assessments to address these concerns, but persistent ambiguities in defining and marking CUI continue to complicate compliance and increase costs across the defense supply chain.
• Industry experts recommend that DoD establish clear, standardized processes and contract-level clarity for CUI categories and markings, including better training and consistent acquisition practices to reduce over-scoping and improve cybersecurity outcomes.
• Stakeholders urge DoD to consider a tiered approach to CMMC requirements based on actual CUI access and to review legacy CUI markings, while some suggest a broader overhaul of the CUI program to simplify categories and improve consistency.