CMMC and NIST SP 800-171 (for AI that handles CUI)

The short version

CMMC and NIST SP 800-171 apply to information systems, not to technologies by name. An AI system falls in scope when it processes, stores or transmits controlled unclassified information (CUI) or provides protection for such a system. We searched the text of 32 CFR Part 170 and NIST SP 800-171 Rev. 3 and found no mention of artificial intelligence or machine learning, so there are no AI-specific CMMC requirements to cite. Our article on CMMC and AI with CUI applies this. For live program names and § 170.19 asset categories, see CMMC Program scoping for generative systems that handle CUI. The tool-buyer brief is CMMC and AI tools handling CUI.

The CMMC program

The CMMC Program utilizes the security standards in 48 CFR 52.204-21, NIST SP 800-171 Revision 2, and selected requirements from NIST SP 800-172. The rule defines the 15 Level 1 requirements, the 110 Level 2 requirements from NIST SP 800-171 R2, and 24 Level 3 requirements from NIST SP 800-172.

The DFARS clause 252.204-7021 requires a contractor to have and maintain a current CMMC status at the level the contracting officer specifies for all information systems used in performance of the contract that process, store, or transmit FCI or CUI. Contractors must also affirm continuous compliance annually.

Current status: Phase 2 suspended (as of 14 October 2026)

DoD CIO says that the first phase of CMMC implementation began on November 10, 2025 and that CMMC implementation is paused in Phase 1. On July 13, 2026 the Department of War announced the immediate suspension of Phase II, which had been scheduled for November 10, 2026. The CIO page says all Phase I self-assessment requirements remain in place and that the suspension does not eliminate the requirement to protect information in accordance with DFARS clause 252.204-7012. The same page says the program may only require self-assessments at two levels during the pause.

The Department’s press release says it will enforce compliance with NIST SP 800-171 Rev 2 through self-assessments and select government-led assessments during the interim and announced a 60-day study of the future of the program. An implementing memo says program managers may only designate CMMC Level 1 (Self) or Level 2 (Self) during the suspension. We found no official announcement of the review’s outcome; check DoD CIO for updates.

Rev 2 versus Rev 3

NIST published SP 800-171 Rev. 3 in May 2024, superseding Rev. 2. The CMMC rule, however, incorporates Revision 2 by reference, and DoD says it is enforcing Rev 2 during the suspension.

Cloud and AI service providers

If an organization uses a cloud service provider (CSP) to handle CUI, the rule requires that the CSP offering is FedRAMP Authorized at the Moderate (or higher) baseline, or meets security requirements equivalent to it. DoD’s equivalency guidance says CSOs must achieve 100% compliance with the latest FedRAMP Moderate baseline as assessed by a FedRAMP-recognized 3PAO, and that equivalency is not authorization.

An external service provider that is not a CSP falls within the organization’s assessment scope when it processes, stores or transmits CUI.

Assessment

NIST SP 800-171A defines three assessment methods: examine, interview and test, which is a useful frame for collecting evidence. See the AI audit evidence checklist, CMMC Level 2 vs Level 3 for AI systems, and the printable DoD contractor CUI path checklist.