CUI
-
DoD Named Machine-Readable Evidence as the Fix. The CUI Tier Isn't There Yet.
The RFI summary Federal News Network obtained puts the cost of CMMC in NIST SP 800-171 implementation and evidence assembly, and the task force's remedies are clearer CUI marking and machine-readable assessment evidence in OSCAL. Microsoft's one published availability table marks every Purview agent capability unavailable in GCC, and it publishes no per-capability table at all for GCC High or DoD.
-
Local Does Not Mean Compliant: NDAA §1532 and the Model You Downloaded
Section 1532 of the FY2026 NDAA has barred DoD contractors from DeepSeek and High Flyer models since January 17, 2026, and a DHS order now reaches third-party products built using DeepSeek implementations in federal civilian systems. Neither instrument asks where the model runs. Both ask where the weights came from.
-
The Prompt Is Now a Data Channel: Keeping CUI Out of the Model
CUI protection was built for data at rest and data in transit. A prompt to a frontier model is neither, and each hop it takes, from prompt to cache to training, carries a different DFARS obligation. GSA's first AI-specific safeguarding clause takes effect October 19, 2026.
-
CMMC Paused. The FAR CUI Rule Didn't.
The CMMC pause touched only third-party verification on DoD contracts. A separate government-wide FAR rule is still moving, and it would extend NIST SP 800-171 Rev 3 to civilian contractors for the first time.
-
CMMC's First Step Is Broken — The Pentagon Still Can't Mark Its Own Data
CMMC's biggest cost driver is not the audit but the Pentagon's decade-long failure to mark its own CUI. Two inspector general reports say the contractors are right.