Summary
Defense manufacturers need to know where CUI lives and how it is protected across their technology environment. CMMC Phase 2 may be paused, but core safeguarding obligations remain. A cloud strategy that accounts for systems, vendors, and security boundaries can make compliance easier to manage and explain.
Why it matters: CMMC Phase 2 is paused, but NIST SP 800-171, DFARS 252.204-7012 and self-assessment obligations remain.
Key Takeaways:
- Know where CUI travels: Map CUI across ERP, quality, shop floor, documents, suppliers and integrations.
- Prepare before compliance questions arrive: Understanding systems, data flows and security boundaries puts teams in a better position to respond.
- Think beyond individual applications: Deltek Costpoint and TIP Technologies connect ERP with quality and manufacturing execution.
As cybersecurity and data protection requirements evolve, defense manufacturers need to look beyond individual applications and ask whether their entire operating environment is ready to protect sensitive government information.
Picture this. A prime contractor emails you on a Monday morning. They want a list of every system that touches your controlled data, where each one is hosted, and who can access it. They want it by Friday.
Could you send it? Or would you spend the week chasing answers across IT, quality, engineering, and three different vendors?
If it's the second one, you're not alone. But it's a problem, and it's growing. In Deltek's 2026 GovCon Clarity Study, 19% of contractors named staying compliant with regulations like CMMC, ITAR, and DFARS as one of their top manufacturing challenge. A year earlier, it was 4%.
Four acronyms, four different questions
CMMC, FedRAMP, ITAR, and CUI are often discussed together, but they are not interchangeable. Understanding the distinction is critical to identifying the security and compliance obligations that apply.
CUI identifies information that requires protection. ITAR establishes access and handling rules for certain defense-related articles, services, and technical data. NIST SP 800-171 defines security requirements for protecting CUI in nonfederal systems and organizations, while CMMC provides the Department of War's (DOW) framework for assessing implementation of applicable CUI protection controls.
When CUI associated with a covered DoW contract is processed, stored, or transmitted by an external cloud service provider, DFARS 252.204-7012 introduces additional cloud-security requirements, including FedRAMP Moderate-equivalent security safeguards where applicable.
These address different aspects of security and compliance, but they lead to one practical question: Do you know which requirements apply to the information, systems, cloud services, and contracts you manage?
Your CUI is in more places than you think
Follow one work order through your plant. Drawings and specs. Inspection plans. First article reports. Nonconformance records with part dimensions and photos. Supplier corrective actions. Calibration and traceability records.
Every one of those can carry technical data. If your quality and shop floor systems store, process, or transmit CUI, they belong in the conversation. In Deltek's 2026 Clarity study, Katie Arrington, who helped create CMMC at the Department of Defense and later performed the duties of the Department of War's CIO, put it this way: "The government defines CUI, but contractors are accountable for how it's handled across their entire environment."
Every extra system is another answer you owe
Now count. How many systems touch that data? How many vendors host them? How many separate security boundaries do you manage? Each one can add responsibilities to understand, a boundary to account for, and another answer you may need when a prime or assessor asks how controlled information is protected.
Fragmentation tends to show up at the worst possible moment: when someone asks. And someone eventually will.
The CMMC pause changed the assessment path, not the underlying obligation
On July 13, the Department of War suspended CMMC Phase 2, which would have brought third-party assessments to more CUI contracts starting November 10. During the review, program offices are limited to self-assessments, and we're still waiting to see how it plays out.
What didn't change: NIST SP 800-171 still governs how CUI must be safeguarded. DFARS 252.204-7012 remains enforceable. Self-assessment is still mandatory for contractors handling CUI. The Pentagon paused the requirement for an outside party to certify compliance. It did not pause the requirement to be compliant.
What it costs you to wait
Let's be direct.
Your attestation still carries weight. When you attest to NIST SP 800-171 compliance in Supplier Performance Risk System (SPRS), you're making a representation the government can rely on. Self-assessment doesn't lower the standard of accuracy expected.
You put access to work at risk. Requirements can flow from primes to suppliers handling CUI. If you can't clearly explain where controlled information lives and how it's protected, you make it harder for a prime to confidently keep you in the supply chain.
You get caught flat-footed. The Monday-morning email won't necessarily arrive on your preferred timeline. Teams that already understand their systems, data flows, and security boundaries are better positioned to respond than teams assembling that picture for the first time.
Complexity gets expensive. When teams have to untangle architecture, ownership, and controls under deadline pressure, complexity stops being an IT inconvenience and becomes a business problem.
So what do you do?
- Map where your CUI travels. ERP, quality, shop floor, documents, suppliers, integrations. Document it.
- Count your environments and security boundaries. If the number surprises you, that's useful.
- Ask every cloud vendor for evidence, not assurances. Is the service FedRAMP Moderate authorized, or equivalent, and what proof can they supply? Where is your data stored, who can access it, and who patches and upgrades it?
- Keep your System Security Plan (SSP) and Plan of Action and Milestones (POA&M) current as if a Level 2 (Self) assessment could be requested tomorrow, because it can be.
- Treat self-attestation like a third-party audit. The mechanism changed. The accuracy you owe the government didn't.
- Build compliance into every modernization project. Don't modernize first and secure it later.
Where Deltek comes in
We've spent decades working alongside government contractors, and one lesson keeps repeating: compliance isn't an application problem. It's an environment problem. Costpoint GovCon Cloud Moderate completed its FedRAMP Moderate Equivalency assessment in 2025, because for our customers, safeguarding CUI is part of doing business.
But manufacturers don't run on ERP alone. Financial data, manufacturing operations, quality processes, and controlled information intersect every day. Costpoint and TIP Technologies already work together today, connecting ERP with quality and manufacturing execution.
The fewer separate boundaries between the systems that hold your controlled data, the shorter your Monday-morning answer gets.
That's the direction defense manufacturers should be thinking about as they modernize: not simply putting more applications in the cloud but building a technology environment around the realities of government contracting.
Cybersecurity Awareness Month is a good excuse. Use it. Because when that Monday-morning email does arrive, the question shouldn't be where to find the answer. It should be how quickly you can send it.
Webinar
Compliance and CMMC, Preparing for What’s Next
Compliance expectations across the supply chain continue to rise. With CMMC Phase 2 paused, your obligations haven’t. Self-assessments, SPRS submissions, annual affirmations, and DFARS 7012 remain in effect. Join us on October 20 to learn what still applies and the practical steps to take now.
