Canonical event record
What happened
The article says the Department of Defense recently suspended third-party assessment requirements for CMMC Phase 2, while suppliers remain responsible for protecting CUI and completing applicable self-assessments.
Why it matters: The guidance emphasizes that defining CUI boundaries and using enclaves may limit compliance complexity and cost without removing underlying security responsibilities.