Buy Now

CMMC Phase 2 is suspended: What defense contractors should still do to protect CUI transfers

by | Oct 27, 2026 | Secure File Transfer | 0 comments

On July 13, 2026, the U.S. Department of War (DoW) suspended Phase 2 of the Cybersecurity Maturity Model Certification (CMMC) program. Phase 2 was scheduled to begin November 10, 2026, and would have required many defense contractors to pass a Level 2 assessment by a CMMC Third-Party Assessment Organization (C3PAO) as a condition of contract award. A C3PAO is an authorized independent assessment organization that evaluates whether a contractor has implemented the security requirements for CMMC Level 2.

If you were preparing for that assessment, the pause gives you time. It doesn’t change what your contracts already require. As one law firm put it, “the third-party certification gate has been lifted; the substantive security requirements behind it have not.”

CMMC covers both Federal Contract Information (FCI) and controlled unclassified information (CUI). FCI is nonpublic information provided by or generated for the government under a contract. CUI is unclassified information that requires safeguarding or dissemination controls under applicable laws, regulations or government-wide policies. Level 1 addresses basic safeguarding of FCI, while Levels 2 and 3 address protection of CUI. This post focuses on CUI transfers and the NIST SP 800-171 requirements used for Level 2.

File transfer is one of the most common ways CUI moves through a contractor’s business: drawings from a prime, specifications to a subcontractor, reports back to a program office. This post follows a CUI file through your file transfer environment, from the moment it arrives to the day you delete it, and shows what to review now and what evidence to have ready when someone asks.

What did the CMMC Phase 2 suspension change?

The suspension removed the requirement for third-party Level 2 certification as a condition of award and paused later phases of the rollout. The DoW also formed a CMMC Reform Task Force to conduct a 60-day review of the program. The department’s implementation memo explains how contracting officers should apply the suspension, and Federal News Network’s coverage describes the reasons behind it.

Since then, industry trackers report that a September 3 class deviation carried the pause into contract language, directing contracting officers to remove third-party assessment requirements. As of late October 2026, the DoW has not published the task force’s findings or a new CMMC timeline. Check for updates before you change your plans.

Which CUI obligations still apply?

Your baseline obligations didn’t change. You still need to meet these requirements:

  • DFARS 252.204-7012: The Defense Federal Acquisition Regulation Supplement (DFARS) clause 252.204-7012 requires you to implement the 110 security requirements in NIST SP 800-171 Rev. 2 and to report cyber incidents through DIBNet within 72 hours.
  • SPRS scores: DFARS 252.204-7019 and 252.204-7020 require a current NIST SP 800-171 assessment score in the Supplier Performance Risk System (SPRS).
  • Phase 1 self-assessments: CMMC Level 1 and Level 2 self-assessments and annual affirmations remain in place.
  • Prime contractor requirements: The suspension doesn’t stop a prime contractor from asking its suppliers for more. Check your subcontracts.

Enforcement continues, too. On September 1, 2026, the U.S. Department of Justice announced that Honeywell Aerospace agreed to pay more than $2 million to resolve allegations that one of its business units didn’t meet NIST SP 800-171 requirements on a network used for Department of Defense contracts. With self-assessment now the main way you show compliance, the accuracy of your SPRS score matters more, not less.

How do you protect CUI data at each stage of a file transfer?

This post organizes a CUI file’s journey through your file transfer server into four workflow stages: receipt, access, transfer and retention. At each stage, you can map what you need to review to specific NIST SP 800-171 requirements, the evidence you should keep and the Cerberus FTP Server by Redwood features that support the work.

These workflow stages span three data states: data in transit, data at rest and data in use. Incoming and outgoing transfers involve data in transit. Files stored after receipt or held for retention are data at rest. Data in use is being actively processed by an application. The access section reviews who can reach and act on CUI; protecting CUI during processing also requires controls on the applications and endpoints that use it.

1. Receipt: Where does the file land, and how did it get there?

What to review:

  • Partners can connect only over encrypted protocols such as SFTP, FTPS or HTTPS, with plain FTP and HTTP turned off (requirement 3.13.8).
  • The encryption uses FIPS-validated cryptography (requirement 3.13.11).
  • The folders where CUI lands are encrypted at rest (requirement 3.13.16).

Evidence to keep: your protocol settings, proof that FIPS mode is on, the certificate number of the validated module and the encryption status of each CUI folder.

How Cerberus supports it: Cerberus FTP Server supports FIPS 140-3 validated cryptography through a single setting, Enable FIPS 140-3, in its security settings. Our guide to the FIPS 140-3 transition explains which module and certificate each Cerberus version uses. For data at rest, Cerberus works with Windows BitLocker or Encrypting File System (EFS), and the Storage Encryption Report shows the encryption status of each user’s folders.

2. Access: Who can open the file?

What to review:

  • Only authorized users can reach CUI folders, and only with the permissions they need (requirements 3.1.1 and 3.1.2).
  • Every person has their own account, so actions trace back to an individual (requirement 3.3.2).
  • Network access requires multi-factor authentication (MFA) (requirement 3.5.3).

Evidence to keep: a list of the accounts that can access each CUI folder, your MFA settings and a record of when you last reviewed access.

How Cerberus supports it: Cerberus ties accounts to Active Directory or LDAP groups and applies permissions folder by folder. It supports two-factor authentication for SFTP and the web client through authenticator apps or Duo, and Cerberus 2026.3 adds RADIUS authentication so you can extend your existing MFA system. IP allow and deny lists, geo-blocking and automatic account lockouts limit who can attempt to connect. The Account and Folder reports show who has access to what.

3. Transfer: Can you prove where the file went?

What to review:

  • Every upload and download is logged with the user, time and source (requirements 3.3.1 and 3.3.2).
  • Outbound transfers to subcontractors use the same encrypted, FIPS-validated protocols as inbound transfers.

Evidence to keep: a report of file activity for any period that you can filter by user or folder.

How Cerberus supports it: The File Report lists each upload and download with the file path, user, IP address, timestamp, protocol and encryption type. The Login Report shows each session, and the Audit Report shows what administrators changed. You can export each report as a CSV file. Cerberus can also verify file integrity with SHA-256 or SHA-512 checksums.

4. Retention: How long do the file and its records stay?

What to review:

  • CUI doesn’t stay on the server longer than the work requires.
  • Logs are kept long enough to support an investigation and are protected from unauthorized changes and deletion (requirements 3.3.1 and 3.3.8).
  • You can meet DFARS 252.204-7012 incident duties, including reporting within 72 hours and preserving images of affected systems for at least 90 days.

Evidence to keep: your file retention rules, your log retention settings and the location of copies of your logs.

How Cerberus supports it: File retention policies automatically delete files once they pass an age you set. For logs, review your logging settings. By default, Cerberus keeps the 10 most recent log files of up to 5,000 KB each, which may not cover the period you need. You can change this in the log4j.xml configuration file and send log events to a syslog server so a copy is kept outside the file transfer server, such as in your security information and event management (SIEM) system. Our post on using file transfer logs and audit trails covers more logging best practices.

What evidence should you have ready?

When a prime contractor, contracting officer or government assessor asks how you protect CUI in transit, these are the questions to expect and where to find the answers in Cerberus:

Question Evidence Where to find it in Cerberus
Is CUI encrypted in transit with validated cryptography? Protocol settings, FIPS mode and module certificate Security settings in Server Manager
Is CUI encrypted at rest? Encryption status of CUI folders Storage Encryption Report
Who can access CUI? Accounts and permissions for each folder Account Report and Folder Report
Is MFA in place? MFA configuration and enrolled users Two-factor authentication and RADIUS settings
Where did a file go? Upload and download history File Report and Login Report
Who changed the server configuration? Administrator activity Audit Report
How long do you keep files and logs? Retention rules and log settings Folder Monitor and logging settings

Report Manager and authenticator-app two-factor authentication require the Enterprise edition. FIPS 140-3 mode and SFTP are included in all editions of Cerberus. For a broader look at how Cerberus features map to CMMC practices, see our guide to CMMC file and data transfer requirements.

Does a Cerberus configuration make you CMMC compliant?

No. No single product makes you CMMC compliant. Your system security plan, policies, training and the rest of your environment all count toward your NIST SP 800-171 score. What Cerberus gives you is a file transfer server that supports the requirements above and produces the records you need to show that it does.

Your CUI file transfer checklist for the next 30 days

  1. Confirm what your contracts and prime contractors require now, and watch for the CMMC Reform Task Force’s findings.
  2. Make sure your SPRS score reflects your current environment.
  3. Turn off unencrypted protocols and turn on FIPS 140-3 mode.
  4. Review who can access each CUI folder and remove accounts that don’t need it.
  5. Require MFA for everyone who connects to the server interactively.
  6. Extend your log retention and forward logs to a central system.
  7. Set file retention rules for CUI folders.
  8. Run each report once and save the output, so you know what your evidence looks like before anyone asks for it.

Keep CUI transfers ready for review

The suspension of CMMC Phase 2’s third-party assessment requirements changes the assessment timeline, while your contractual obligations to protect CUI remain in place. Cerberus FTP Server by Redwood supports that work with FIPS 140-3 validated cryptography, granular access control, MFA and reporting. Review your configuration and keep the supporting records current so you can show how your file transfer environment protects CUI when a customer or assessor asks.

Start your free 25-day trial or explore Cerberus security features.

Sources and further reading

U.S. government guidance and regulations

Industry analysis

Cerberus resources

 

Related posts:

  1. OpenSSL vulnerability fixed in Cerberus FTP Server version 11.3.6
  2. Cerberus FTP Server 12.10 presents Independent Directory and File Level Permissions
  3. Disaster Recovery and High Availability for File-Transfer Systems
  4. Everything file transfer admins need to know about the FIPS 140-3 transition