# DoD Contractors Assess CUI Browser Controls

Contractors handling Controlled Unclassified Information (CUI) are evaluating whether subcontractors can access prime-contractor portals from Chrome-enabled workstations without syncing credentials, autofill data, tabs, or potentially sensitive information to personal or commercial accounts. The discussion emphasizes that contract flow-downs and system scoping determine whether a subcontractor may receive CUI; browser choice alone does not establish authorization. It also reports CMMC Level 2 assessments appearing in contracts following the stated November 10 start of Phase 2, although the year is unspecified.

- Procurement and security teams should verify contract flow-downs and system boundaries before granting a subcontractor access to CUI or a prime’s SharePoint portal.
- Where access is authorized, organizations can evaluate managed browser settings, restricted sync, and controlled portal access to reduce the risk of credentials or sensitive data moving to unapproved accounts.
- The appearance of CMMC Level 2 assessments in contracts makes assessment readiness relevant to contractors pursuing or performing DoD work; the signal does not specify a universal compliance deadline or a requirement to harden browsers beyond applicable guidance.

**Jurisdictions:** federal
**Industries:** Defense & Military, Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 09, 2026

### Government Entities
- U.S. Department of Defense (DoD)
- National Institute of Standards and Technology (NIST)

### Vendors
- Google (Chrome provider)
- Microsoft (SharePoint platform provider)

### Key Quotes
> I’m dealing with that now, where the contract between prime and sub specifically prohibits transfer of CUI to the sub.
> — Community commenter

### Sources
- [CUI Access through chrome?](https://www.reddit.com/r/CMMC/comments/1xrt6w6/cui_access_through_chrome) - reddit-cmmc