When sensitive data moves everywhere, security attestations become a liability

COMMENTARY: For years, defense contractors treated cybersecurity compliance as a technical obligation—important, contractual, but largely administrative. That framing no longer holds.

Despite the Department of Defense’s recent pause on Phase 2 of Cybersecurity Maturity Model Certification (CMMC) implementation, cybersecurity compliance will inevitably become something else entirely, namely a governance and legal risk anchored in senior-official affirmations. And at the center of that risk we see a factor many organizations still underestimate: how controlled unclassified information (CUI) actually spreads.

CUI Is contextual, and that changes everything

Most compliance programs assume that CUI exists as static, clearly labeled, deliberately handled, and confined to designated systems. In practice, it’s contextual. It becomes protected not because of its format, but because of how and where it’s used.

[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]

That distinction matters because it’s hard to control context.

Across the defense industrial base, CUI routinely propagates through ordinary business activities:

In each case, the data itself may appear innocuous. The compliance obligation follows use and context, not intent.

Once introduced, CUI spreads across systems, cloud platforms, endpoints, and vendors, often without formal designation or tracking. This CUI propagation creates a cybersecurity problem before it becomes a compliance problem because appearing in unexpected locations can create blindspots that undermine cybersecurity effectiveness as well as compliance.

Affirmations assume visibility that rarely exists

These blindspots can now carry more severe consequences. Under 32 CFR Part 170, organizations must submit CMMC affirmations into the supplier performance risk system (SPRS), signed by a senior official. These affirmations represent that the organization meets the required CMMC level for the systems and information in scope.

Here's the problem: affirmations presume accurate, current knowledge of where CUI exists.

If CUI has propagated into collaboration platforms, legacy systems, unmanaged endpoints, or supplier environments without the organization’s full awareness, then the affirmation may no longer reflect reality, even if controls were properly implemented in the originally scoped systems.

Under the False Claims Act, liability does not require intent to deceive. Reckless disregard or deliberate ignorance is sufficient. Affirming compliance without reasonable assurance that all CUI locations are identified, protected, and monitored creates exposure precisely because verification now follows attestation.

CMMC does not introduce affirmations for the first time. It introduces verification after affirmation, transforming theoretical risk into documented discrepancies.

Repetition multiplies exposure

CMMC affirmations are not one-time events. Depending on certification level and contract structure, organizations must affirm:

When CUI propagation goes unrecognized, each affirmation becomes a potential liability event. The whistleblower provisions of the False Claims Act further elevate risk by incentivizing individuals with internal knowledge to report discrepancies between affirmations and actual practice.

Supply chains expand the risk surface

CMMC flow-down requirements apply based on information handling, not organizational intent. When CUI propagates to subcontractors—even indirectly—certification obligations follow.

This creates compounding risk:

In such cases, it’s not about malicious conduct. It’s incomplete visibility into how information moved. But under the False Claims Act, that distinction offers limited protection.

Why it’s a governance issue, not an IT issue

CUI propagation exposes a fundamental governance challenge. Cybersecurity controls alone cannot manage contextual data spread. It matters whether organizations have defensible processes to:

Without these capabilities, affirmations become assumptions, and assumptions are a weak defense in an enforcement regime built on verification.

CMMC did not create CUI propagation. It exposed it.

By requiring senior-official affirmations backed by third-party verification, the Defense Department has converted an operational blindspot into a legal risk. Organizations that continue to treat CUI as static data will struggle to substantiate compliance claims, even in good faith.

For compliance and risk leaders, the implications are clear: we can’t mitigate affirmation risk without understanding how CUI spreads.

CMMC compliance is no longer about whether controls exist: it’s about whether leaders can stand behind what they sign.

Justin Beals, co-founder and CEO, Strike Graph

SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.