on 4 November, 2026
CMMC and Your Copiers: What NIST 800-171 Means for MFPs in 2026
If your copiers print, scan, store or send CUI, they are in your CMMC scope. Where the program stands in November 2026, the NIST SP 800-171 requirements that reach MFPs, and a checklist.
If your company holds a Department of Defense (DoD) contract or subcontract and your copiers print, scan, store or send controlled unclassified information (CUI), those MFPs are in your CMMC assessment scope and must meet the same NIST SP 800-171 requirements as your computers. As of November 2026, CMMC is in Phase 1, which calls for self-assessments, and the planned November 2026 move to third-party assessments is suspended. The requirements themselves have not changed, so the copier fleet still needs encryption, access control, logging, patching and documented sanitization at lease end.
This guide is general information, not legal advice, so confirm your obligations with your contracting officer, compliance lead or counsel.
Who needs CMMC?
CMMC applies to DoD contractors and subcontractors that will process, store or transmit Federal Contract Information (FCI) or CUI on their own information systems while performing a contract. It covers contracts above the micro-purchase threshold, except those solely for commercially available off-the-shelf (COTS) items, and it flows down to subcontractors. A company that handles only FCI needs Level 1. A company that handles CUI needs Level 2, and DoD can designate Level 3 for certain contracts.
Copiers matter even if your CUI arrives on paper. DoD's CMMC guidance says paper-only organizations do not need a third-party assessment, but once that CUI is scanned, printed, emailed or uploaded, the system it lands on is expected to meet CMMC requirements first. A scan at the office MFP is that moment.
Where does CMMC stand in November 2026?
- Program rule. 32 CFR part 170 took effect December 16, 2024. It sets the levels, the assessments and a four-phase rollout.
- Acquisition rule. The DFARS rule that puts CMMC into contracts through clause 252.204-7021 took effect November 10, 2025, starting Phase 1: Level 1 (Self) or Level 2 (Self) as a condition of award.
- Phase 2, suspended. Phase 2 was set for November 10, 2026, when Level 2 assessments by an authorized third-party assessor (a C3PAO) would have become a condition of award. On July 13, 2026, the department, which now also uses the name Department of War, suspended Phase 2 and began a review of the program.
- During the suspension. Program managers may require only Level 1 (Self) or Level 2 (Self). Third-party Level 2 and Level 3 requirements are being removed from active solicitations and existing contracts.
Phase 1 self-assessments remain in place, the DoD CIO says the department will enforce NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments, and DFARS clause 252.204-7012 still requires NIST SP 800-171 for covered defense information. The part 170 rule text has not changed, so check the DoD CIO's CMMC page before planning around any date.
The CMMC levels in brief
| Level | Requirements | How it is assessed |
|---|---|---|
| Level 1 | 15 basic safeguarding requirements in FAR 52.204-21 (protects FCI) | Self-assessment and affirmation every year |
| Level 2 | 110 requirements in NIST SP 800-171 Revision 2 (protects CUI) | Self-assessment every three years with annual affirmation; third-party assessment suspended for now |
| Level 3 | Level 2 plus 24 requirements from NIST SP 800-172 | Government assessment by DCMA DIBCAC every three years; not being required during the suspension |
Results go into the Supplier Performance Risk System (SPRS). NIST has published Revision 3 of SP 800-171, but CMMC assesses against Revision 2 until DoD updates the rule.
Which NIST SP 800-171 requirements apply to copiers?
Under the CMMC scoping rule, any asset that processes, stores or transmits CUI is a CUI asset: it goes in your asset inventory, system security plan (SSP) and network diagram, and it is assessed against all Level 2 requirements. A networked MFP that scans, prints or stores CUI fits that description. NIST SP 800-171 itself names copiers, printers or fax machines in its guidance on configuration, maintenance, sanitization, physical access, vulnerability scanning and encryption in transit.
| Area | NIST SP 800-171 Rev. 2 | What it means at the copier |
|---|---|---|
| Media protection | 3.8.1, 3.8.2, 3.8.3 | Protect CUI on the drive and in the output tray; sanitize the drive before disposal or reuse |
| Access control | 3.1.1, 3.1.2, 3.1.5 | Only authorized users at the panel and web console; limit who can change settings |
| Authentication | 3.5.1, 3.5.2, 3.5.3 | Individual sign-in by badge, PIN or login; no default credentials; multifactor for admin access, local or network, and for users' network access |
| Audit logging | 3.3.1, 3.3.2 | Job and access logs that trace each print, copy, scan and fax to a user |
| Configuration | 3.4.1, 3.4.2, 3.4.6, 3.4.7 | A documented baseline for each model; unused ports, protocols and services turned off |
| Encryption | 3.13.8, 3.13.11, 3.13.16 | Encrypted drive; encrypted print, scan and admin traffic; FIPS-validated cryptography where it protects CUI |
| Flaws and patching | 3.14.1, 3.14.3, 3.11.2 | Firmware updated on a schedule; printers included in vulnerability scans |
| Maintenance | 3.7.3, 3.7.5, 3.7.6 | Sanitize before equipment leaves for repair; supervise technicians who lack access authorization; multifactor for remote maintenance |
Scan-to-email and scan-to-folder
Every scan destination is a CUI path you must control (requirement 3.1.3) and encrypt in transit (3.13.8). Send scan-to-folder jobs only to in-scope shares over an encrypted protocol with a least-privilege service account, and relay scan-to-email through your own mail system over an encrypted connection. If scans land in a cloud mailbox or cloud storage, DFARS 252.204-7012 requires a provider that meets security requirements equivalent to the FedRAMP Moderate baseline. Remove scan-to-USB and any destination you cannot document.
Fax
Requirement 3.13.8 names fax machines among the components that transmit information and requires cryptographic protection for CUI in transit unless alternative physical safeguards apply. Disable fax on machines that handle CUI or document in the SSP how fax traffic is protected; fax memory and forwarding also store CUI on the machine.
Secure disposal at the end of the lease
Requirement 3.8.3, and its Level 1 counterpart in FAR 52.204-21, says to sanitize or destroy media containing CUI or FCI before disposal or release for reuse, and a returned lease copier is headed for reuse. NIST SP 800-88 Revision 2 (September 2025) defines three methods: clear, purge and destroy. It notes that office equipment may offer only a factory reset, which counts as clear, and that purge, including cryptographic erase, can suit a lease return better than destroy. DoD's CMMC guidance accepts cryptographic erase when it is done in line with SP 800-88. Either way, keep a certificate of sanitization for each drive: model, serial number, method, tool, verification and who performed it.
A practical checklist for copiers that touch CUI
- Inventory every copier, MFP and printer that handles CUI (model, serial number, firmware, network address) and add each to the SSP and network diagram.
- Decide which machines may handle CUI and keep the rest off that network segment.
- Turn on drive encryption and automatic image overwrite, and confirm the drive is encrypted, not only password-locked.
- Require individual sign-in at the panel and secure release printing, so pages print only when the user is there.
- Replace default admin passwords, use named admin accounts, and restrict the web console to an admin workstation or management network.
- Disable unused protocols, services and connectors, and require encrypted connections for administration, printing, directory lookups and scanning.
- Lock scan destinations to approved folders and your own mail relay.
- Send job and audit logs to your log system and review them.
- Update firmware on a schedule and include every printer in vulnerability scans.
- Supervise service visits and remote diagnostics, sanitize before anything leaves for repair, and at lease end sanitize to NIST SP 800-88 and keep a certificate for each drive.
Defense supply chains in DEX markets
DEX Imaging serves several regions where military installations anchor networks of primes, subcontractors and suppliers.
The Space Coast
Brevard County is home to Patrick Space Force Base, where Space Launch Delta 45 oversees launches from Cape Canaveral Space Force Station, the Defense Department's East Coast space launch facility. NASA's Kennedy Space Center next door works with about 100 private-sector partners, although CMMC attaches only to DoD contracts. DEX's Melbourne office serves the county from Palm Bay to Titusville.
Maryland
Fort George G. Meade is the Army's second-largest installation by population, with more than 120 partner agencies, including the National Security Agency, U.S. Cyber Command and the Defense Information Systems Agency. Aberdeen Proving Ground, the Army's oldest proving ground, is a major research, development, test and evaluation center and home to the Army Communications-Electronics Command. DEX's Baltimore team works from Owings Mills and covers Annapolis and Columbia.
The Florida Panhandle
Naval Air Station Pensacola, the "Cradle of Naval Aviation," is where every Naval Aviator, Naval Flight Officer and enlisted aircrewman begins flight training. Eglin Air Force Base's 96th Test Wing tests air-delivered weapons, navigation and guidance, and command and control systems for the Air Force, and Hurlburt Field is home to the 1st Special Operations Wing. DEX serves the region from Pensacola and Fort Walton Beach.
San Antonio
Joint Base San Antonio brings together JBSA-Fort Sam Houston, JBSA-Lackland, JBSA-Randolph and JBSA-Camp Bullis, with the 502nd Air Base Wing providing installation support across all of them. DEX's San Antonio office serves Bexar County, Schertz, Universal City and New Braunfels.
Fayetteville
The installation next to Fayetteville is officially Fort Bragg again: the Army renamed Fort Liberty in February 2025, this time honoring World War II soldier Pfc. Roland L. Bragg. It is home to the 82nd Airborne Division and U.S. Army Special Operations Command. DEX's Fayetteville office covers Fayetteville, Fort Bragg, Spring Lake, Hope Mills and Raeford.
How DEX helps
DEX can configure the security settings on the Konica Minolta, Kyocera, Canon, Ricoh, HP and Sharp equipment it supplies and keep firmware patched as part of ongoing fleet management. At lease end, your DEX rep will ask whether you want its hard drive wiped, and DEX will wipe it for you if you do. CMMC status and assessments belong to your company, so DEX works alongside your compliance lead, not in place of one. See secure print for defense contractors, print security and DEX Managed IT cybersecurity, or request a quote.
Frequently asked questions
Do copiers and printers count in a CMMC assessment?
Yes, if they process, store or transmit CUI. They are then CUI assets that belong in your inventory, SSP and network diagram and must meet the Level 2 requirements.
Is CMMC still required now that Phase 2 is suspended?
Yes, where a solicitation or contract includes it. Phase 1 self-assessments remain in place, and DFARS 252.204-7012 still requires NIST SP 800-171 for covered defense information. Only the third-party Level 2 and Level 3 assessment requirements are paused.
Is the copier's built-in data wipe enough at lease return?
It can be. NIST SP 800-88 treats a manufacturer reset or overwrite as clear, while purge methods such as cryptographic erase give more assurance. Decide which method your CUI requires, verify the result, and keep a certificate of sanitization for each drive.