CMMC Program scoping for generative systems that handle CUI

Search results still say “CMMC 2.0.” The live rule text does not. This page records the names official pages actually use, then applies 32 CFR 170.19 asset categories to generative components that might handle CUI. It is not a rewrite of CMMC and AI with CUI (the three-step CUI path) or CMMC Level 2 vs Level 3 for AI systems (the level comparison).

CMMC pages we cite do not say Super Intelligence. This article keeps the Program’s FCI, CUI and information system terms. Where this site speaks in its own voice about current U.S. executive-branch policy it uses Super Intelligence (SI); that voice does not rewrite 32 CFR Part 170.

What official pages actually call it

32 CFR Part 170 is titled Cybersecurity Maturity Model Certification (CMMC) Program. The opening paragraph says this part describes the Cybersecurity Maturity Model Certification (CMMC) Program of the Department of Defense (DoD) and then calls itself the CMMC Program.

DoD CIO’s About CMMC page uses the same heading: Overview of the CMMC Program. The CMMC Model Overview PDF is marked Version 2.13 | September 2024. That is a model-document version, not a statement that the Code of Federal Regulations is named “CMMC 2.0.”

One live DoD industrial-base page still uses the older shorthand in its title: CMMC 2.0 Details and Links to Key Resources. The body of that page, as fetched on 14 October 2026, discusses the 13 July 2026 Phase II suspension and points to DoD CIO. We searched the eCFR Part 170 text for “CMMC 2.0” and found no match. Analysis: treat “CMMC 2.0” as a search label and a resource-page title, not as the legal name of the program in the rule.

What § 170.19 actually scores

§ 170.19 says the CMMC Assessment Scope must be specified prior to assessment and that the scope is the set of all assets in the OSA’s environment that will be assessed against CMMC security requirements. For Level 2, table 3 lists four in-scope categories and one out-of-scope category:

We searched 32 CFR Part 170 for “artificial intelligence,” “machine learning” and “generative” and found no matches as of 14 October 2026. The categories above are technology-neutral.

Putting a generative component into those categories

Analysis, not sourced fact. The rule does not name prompts, retrieval indexes or chat logs. The questions § 170.19 actually asks are whether an asset processes, stores, or transmits CUI, can but is not intended to, provides security functions, or cannot. A contractor still has to document that call in the asset inventory, SSP and network diagram the table requires.

Typical generative pieces, scored only against those verbs:

• Prompt and upload paths, retrieval indexes, fine-tuning sets, and logs or chat history that can reproduce CUI are CUI Assets if they process, store or transmit CUI. DFARS 252.204-7021 uses the same process/store/transmit test for the CMMC status itself.
• A model endpoint that never receives CUI and is physically or logically separated can be argued as Out-of-Scope. The table says assets that fall into any in-scope asset category cannot be considered an Out-of-Scope Asset, so the separation has to be real.
• A desktop coding assistant that can receive CUI but is banned from doing so by policy is the Contractor Risk Managed Assets fact pattern: can, but are not intended to. That category is still in the Level 2 assessment scope; it is not a free pass.
• Logging, DLP or access-control tooling that protects the CUI path is a Security Protection Asset even if the tool never sees the CUI payload.

Cloud versus other external providers is table 4, not a separate AI rule. If a cloud service provider processes, stores or transmits CUI, the CSP shall meet the FedRAMP requirements in 48 CFR 252.204-7012. § 170.16 states the Level 2 (Self) version of that cloud test as FedRAMP Authorized at the Moderate (or higher) baseline, or … equivalent. If the provider is not a CSP, the services provided by the ESP are in the OSA’s assessment scope.

Current phase, in one paragraph

DoD CIO says the CMMC Program is paused in Phase 1 and may only require self-assessments at two levels, that Phase II was suspended on 13 July 2026, and that this does not eliminate the requirement for companies to protect information in accordance with DFARS clause 252.204-7012. The implementing memo says requiring activities may only designate CMMC Level 1 (Self) or Level 2 (Self) during the suspension. Scoping under § 170.19 still matters for those self-assessments. Check DoD CIO before treating a later phase as current.

Questions

Is the legal name of the program CMMC 2.0?

Not in 32 CFR Part 170. The live rule and DoD CIO overview say CMMC Program. CMMC 2.0 Details and Links to Key Resources is a live Office of Industrial Base Growth page title. The CIO model overview is Version 2.13.

Does a generative model automatically become a Specialized Asset?

No source we cite says that. Specialized Assets are a listed set: IoT, IIoT, OT, GFE, Restricted Information Systems, and Test Equipment that can process, store, or transmit CUI but are unable to be fully secured. A chat service is not on that list just because it is generative.

If logs never leave the vendor, are they out of scope?

Out-of-scope requires that the asset cannot process, store, or transmit CUI and does not provide security protections for CUI Assets. Vendor-hosted logs that store CUI are storage. Document the category in the SSP; do not infer it from a model card.

See the CMMC / NIST SP 800-171 explainer and the printable DoD contractor CUI path checklist.