CUI Marking Chaos Elevates CMMC Costs and Confusion for DoD Contractors

The DoD's inconsistent and unclear process for marking controlled unclassified information (CUI) keeps driving higher costs and confusion in the Cybersecurity Maturity Model Certification (CMMC) program, with industry groups warning overmarking, blanket flow-downs to subcontractors, and unclear CUI scope. They urge clearer, standardized CUI definitions, better guidance and training, and more selective CMMC application—especially for small businesses—alongside reforms to consolidate CUI categories and clarify contract-level expectations.