CMMC Phase II Pause Leaves Phase I Self-Assessments in Place

A report says the Pentagon suspended CMMC Phase II requirements while Phase I self-assessment requirements remain in place. It also says contractors continue to have applicable obligations to safeguard defense information.

Key details

• The reported change concerns CMMC Phase II requirements; Phase I self-assessment requirements remain in place, according to the report.
• The report identifies CAD models, technical drawings, bills of material, manufacturing instructions and test results as engineering records that may contain Controlled Unclassified Information, depending on their content and context.
• Engineering information can move among CAD and product lifecycle management systems, internal teams and suppliers.
• The report distinguishes CMMC, which assesses contractor protection of Federal Contract Information and Controlled Unclassified Information, from FedRAMP, which provides a standardized assessment and authorization approach for cloud services used by federal agencies.
• PTC describes Windchill+ FedRAMP as a cloud-based product lifecycle management offering for product definitions, configurations and engineering changes.

The report says Phase I self-assessment requirements remain in place during the reported Phase II pause.

Why it matters

Engineering records can move across systems and organizations, so contractors must consider how they handle information beyond records held in a single platform. Product lifecycle management systems can manage permissions, revision history and approved changes, while contractors remain responsible for their own environments and information handling.