# Contractors Flag CUI and CMMC Burdens

Comments on the RFI response describe persistent uncertainty among defense contractors about how to identify, mark, and control Controlled Unclassified Information (CUI). Participants say blanket or inconsistent CUI marking can extend CMMC-related costs and flow-down obligations to small and lower-tier suppliers, including businesses whose work may involve little or no sensitive information. Commenters differ on potential remedies, including retaining independent certification and stronger accountability, using self-attestation, or narrowing CUI coverage.

- Procurement teams should verify which CUI handling and CMMC requirements apply to each contract rather than treating every requested certification level as mandatory.
- Prime contractors should assess how data-designation decisions and contract flow-downs affect lower-tier suppliers, especially small businesses.
- Contractors can document contract-specific requirements and their compliance approach to address uncertainty around marking and handling obligations.
- The range of proposed remedies signals disagreement over how to balance implementation costs with certification and accountability; the comments do not establish a finalized change to requirements.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** October 27, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- National Institute of Standards and Technology (NIST)
- U.S. Small Business Administration (SBA)
- National Archives and Records Administration (NARA)
- Naval Sea Systems Command (NAVSEA)

### Vendors
- McMaster-Carr (COTS parts supplier cited as an example)

### Key Quotes
> I'm now in a spot where I have to send out CUI readiness questionnaires to heat treat suppliers, plating houses, stamping places that are already doing all this COMPLETELY uncontrolled for the OEM, but because it's part of the government contract flow I have to pressure the lower-level subcontractors.
> — Community commenter

> When Primes call it out or question it via RFI, the Government throws up its hands and says “we can’t tell you how you should handle the documents we give you - you figure it out.”
> — Original poster

### Sources
- [The first reports on the RFI response.](https://www.reddit.com/r/CMMC/comments/1xgqgh8/the_first_reports_on_the_rfi_response) - reddit-cmmc