# Defense Suppliers Refine CMMC Scope

An Aviation Week sponsored article from Exostar advises small defense suppliers to trace where controlled unclassified information (CUI) is handled and define a defensible Cybersecurity Maturity Model Certification (CMMC) scope. Suppliers are urged to weigh enterprise-wide implementation against a segmented enclave based on how much of their business supports Department of Defense work. Although the reported suspension of CMMC Phase 2 third-party assessment requirements changes the near-term assessment path, it does not eliminate CUI protection responsibilities or Level 1 and Level 2 self-assessment requirements.

- Suppliers should map CUI flows, assign responsibility, and maintain documented evidence while deciding whether enterprise-wide controls or a segmented enclave best fits their DoD work.
- The change affects the near-term assessment approach, not suppliers’ underlying obligations to protect CUI or complete applicable self-assessments.
- Procurement teams and prime contractors can use clear, documented CMMC scope decisions to assess supplier readiness and understand how subcontractors handle CUI.
- The article is sponsored content, and Exostar’s product capabilities are presented by the company; stakeholders should account for that context when evaluating its recommendations.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity
**Published:** October 27, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- National Institute of Standards and Technology (NIST)

### Vendors
- Exostar (Sponsored-content provider presenting cybersecurity solution capabilities)
- Microsoft (Provider of the GCC High cloud environment referenced as an enclave option)

### Sources
- [Scope And Cost: A Cybersecurity Guide For Small Defense Suppliers | Aviation Week](https://aviationweek.com/defense/scope-cost-cybersecurity-guide-small-defense-suppliers) - Aviation Week