# Defense Contractors Map CUI for CMMC Readiness

The Pentagon’s suspension of CMMC Phase II requirements in July 2026 paused the planned expansion to default third-party assessments, but it did not remove Phase I self-assessment requirements or contractors’ existing obligations to protect controlled unclassified information (CUI) where contract terms require them. For defense contractors, the signals identify a continuing need to trace CUI through engineering and supplier workflows and assess product lifecycle management (PLM) and cloud controls, including applicable DFARS 252.204-7012 requirements. MSPs and MSSPs may find services opportunities helping contractors discover, map, and continuously monitor CUI to define a defensible assessment scope.

- Contractors should map CUI flows across engineering and supplier processes and review the PLM and cloud environments that handle the data.
- Applicable CUI safeguards and contract terms remain relevant despite the Phase II pause; the pause should not be treated as a waiver of existing obligations.
- MSPs and MSSPs can offer CUI discovery, workflow mapping, and continuous monitoring services to support contractors’ Phase I readiness and appropriately scoped assessments.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 10, 2026

### Government Entities
- U.S. Department of Defense (DoD)

### Vendors
- PTC (Cloud PLM solution provider; offers Windchill+ FedRAMP)

### Sources
- [Beyond the CMMC pause: Protecting the engineering data defense programs depend on - Breaking Defense](https://breakingdefense.com/2026/11/beyond-the-cmmc-pause-protecting-the-engineering-data-defense-programs-depend-on) - Breaking Defense
- [CUI Data Discovery for CMMC Readiness in 2026: A Guide for MSPs | Cavelo - Security Boulevard](https://securityboulevard.com/2026/11/cui-data-discovery-for-cmmc-readiness-in-2026-a-guide-for-msps-cavelo) - Security Boulevard