Ask five questions before you choose a path
What do the terms say?
Read the contract and subcontract. The clause and flowed-down terms set the obligation.
What is the information?
Identify its source, markings, handling instructions, and unresolved questions. A customer label alone may not settle the classification.
NDIA’s 2026 report describes industry concerns about inconsistent CUI markings. Record the uncertainty and ask your customer to resolve it before planning around a label. NDIA report, page 32.
Where does it move?
Map receipt, storage, processing, sharing, and disposal through the work. That map shows where the obligation applies.
Which systems and people touch it?
Define the operational boundary your implementation must cover. Include service providers when their services support the covered work.
What response does the customer require?
Separate basic safeguards, NIST-based work, assessment status, evidence, and customer review. Each asks your team to do something different.
For example, a distributor receives a purchase order and delivery schedule for a government program. That information may call for an FCI analysis under the relevant terms. Later, the distributor receives technical drawings with controlled markings and stores them in a separate collaboration environment. The second fact changes the questions. Document the information, system boundary, and clauses for that work rather than applying the first conclusion to both environments.
Keep Level 1 and Level 2 in their lanes
The CMMC clause describes different levels and assessment routes. In broad terms, Level 1 aligns to the FAR basic safeguarding requirements and uses a self-assessment route when the governing terms require it. Level 2 concerns the NIST SP 800-171 Rev. 2 requirements for the relevant systems and has its own assessment and affirmation structure. The solicitation or contract, work, and current implementation direction decide the route. A request for “CMMC” does not decide it by itself.
For current context, the Department announced a suspension of Phase II requirements in July 2026 while retaining Phase I self-assessments. That announcement does not resolve an individual contract. Read the announcement, then check the implementing instructions, your actual terms, and applicable amendments or modifications.
Deep Fathom helps teams organize requirements, assigned work, and evidence tied to the relevant systems and information. It does not classify information or decide applicability for your contract. Bring one requirement, a description of the information, and the supporting systems to a platform evaluation conversation.