DoD contractor AI + CUI checklist

NIST SP 800-171 applies to components of nonfederal systems that process, store, or transmit CUI, or that provide protection for such components. 32 CFR 170.19 is the CMMC scoping rule.

DFARS 252.204-7021 requires a CMMC status for all information systems used in performance of the contract that process, store, or transmit FCI or CUI.

A search of 32 CFR Part 170 for “artificial intelligence” and “machine learning” found no matches as of 14 October 2026. Levels are information-system levels.

CUI Assets process, store, or transmit CUI and are assessed against all Level 2 requirements. Contractor Risk Managed Assets can but are not intended to. Out-of-Scope assets cannot, and do not protect CUI Assets.

For CMMC Level 2, an organization may use a cloud environment for CUI only if the offering is FedRAMP Authorized at the Moderate (or higher) baseline, or meets security requirements equivalent to it.

Table 4 to § 170.19: when the ESP is not a CSP and processes CUI, the services are in the OSA’s assessment scope and shall be assessed as part of the OSA’s assessment.

Use of an external service provider and its services is documented in the SSP and described in the provider’s service description and CRM.

Level 2 security requirements are identical to NIST SP 800-171 R2. DoD CIO says it is enforcing Rev 2 during the current suspension.

DoD CIO says the CMMC Program is paused in Phase 1 and may only require self-assessments at two levels. The implementing memo allows only Level 1 (Self) or Level 2 (Self) designations during the suspension.

The suspension does not eliminate the requirement to protect information under DFARS clause 252.204-7012.