Last Call: “FAR CUI Rule” Draft Language Provides an Opportunity for Contractors to Weigh in by this Week

The FAR Council recently released an updated draft of the much-anticipated “FAR CUI Rule” that would apply to contractors government-wide.

For background, Controlled Unclassified Information (CUI) is generally defined as “information that the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls.” 32 CFR § 2002.4(h). This broad categorization encompasses over 100 categories of unclassified information. Current CUI categories are listed in the National Archives and Records Administration (NARA) CUI Registry. Protecting CUI has been a key government priority in recent years, but contractual expectations have not been consistent across government buyers.

Building on concepts from a prior proposed rule issued in January 2025, the FAR Council has released a new formulation—open for public comment—that includes a proposed solicitation provision (FAR 52.240-6) and a proposed contract clause (FAR 52.240-7), both addressing contractor requirements for protecting CUI.  The instructions for administering these protections are found in proposed FAR 40.304.

The proposed solicitation provision and clause would apply only when CUI is expected to be involved in the contract (see FAR 40.304-3 (draft)). As in the January 2025 iteration, this version proposes a Standard Form that will be incorporated into contracts to identify the specific CUI involved.

FAR 52.240-6 – Notice of Controlled Unclassified Information Requirements

For offerors responding to a solicitation, the draft provision includes three main categories of obligations:

• Offerors must not use “Government-provided information” for their own purposes, whether or not the information is marked as CUI, unless the information is in the public domain or was lawfully made available to the offeror by someone other than the Government. If any such information is CUI, the offeror must comply with agency procedures for protecting CUI.
• Offerors should notify the contracting officer within 72 hours of discovering any information within the scope of the solicitation that the offeror believes is CUI that is unmarked, mismarked, or involved in a “CUI incident” as defined by FAR 52.240-7. Offerors have a responsibility to safeguard any such information as CUI until a contracting officer makes a determination.
• Offerors must submit a plan of action and milestones (POA&M) disclosure with their offer if they are not compliant with any of the requirements in FAR 52.240-7.

FAR 52.240-7 – Controlled Unclassified Information

The proposed clause includes several key obligations for contractors:

• Under this clause, contractors are required to safeguard CUI only when it is identified in the incorporated Standard Form. However, there is a significant caveat: contractors must notify the government within 72 hours of discovering any information that they believe is potentially CUI and safeguard it until the government determines otherwise.  Contractors must also identify information the contractor owns and provides to the government (which the clause says could include “e.g., contractor bid or proposal information, contractor-attributional information, or contractor proprietary business information”), for the purpose of allowing the government to determine whether the government must protect it in accordance with its own CUI requirements or other protections.
• Contractors are required to mark CUI in accordance with the Standard Form and comply with CUI handling requirements:
  • • When operating federal IT systems, contractors must comply with agency-identified security requirements from the latest version of NIST SP 800-53, along with any CUI Specified requirements outlined in the Standard Form. If using cloud computing services, contractors must meet security requirements at no less than the FedRAMP Moderate baseline.
    • When operating non-federal government (e.g., contractor) IT information systems, contractors must implement NIST SP 800-171 Rev. 3, along with any CUI Specified or NIST SP 800-172 requirements identified by the agency. If using a cloud service provider to store, process, or transmit CUI, the provider must meet security requirements equivalent to the FedRAMP Moderate baseline. The clause expressly excludes virtual desktop infrastructure (VDI) setups and certain commercial communications networks from its scope.
• Contractors must make their system security plans (SSPs) and POA&Ms available to the government “upon request.”
• The clause provides a detailed description of CUI incident response procedures, including a 72-hour reporting timeline—a significant loosening of the eight-hour timeline previously proposed. The clause also requires contractors to report, within 72 hours, any perceived inability to comply with the clause due to a conflict of law or regulation.
• Contractors must also flow down the substance of this clause and information from the Standard Form to subcontractors, when the subcontract requires access to, or the ability to access, the CUI identified in the Standard Form. Contracts for solely commercial-off-the-shelf items are excluded.

Takeaways for Federal Government Contractors

This revised “FAR CUI Rule” proposal, if adopted, would establish greater uniformity and clarity across the federal government for protecting CUI. It would also represent a significant compliance commitment. Its inclusion in the latest Revolutionary FAR Overhaul work signals the government's intent to follow through.

Contractors can take meaningful steps now to prepare.

• For contractors that have not previously handled CUI—or that have not contracted with agencies such as the Department of War (DoW) that have more established CUI requirements—consider what CUI you may be handling and what the FAR CUI Rule may require.
• For any contractor, now is also a good time to conduct a privileged review of your current cybersecurity posture against NIST SP 800-171 Rev. 3 security controls. Notably, the proposed clause requires compliance with Rev. 3, as opposed to Rev. 2, which is currently required under DoW’s CMMC program and significantly different than Rev. 3. Those differences could create challenges for contractors attempting to safeguard CUI in accordance with multiple contract requirements.
• Contractors relying on cloud service providers can also begin assessing potential CUI dataflows and their providers’ FedRAMP status, including whether arguments of “equivalence” can be made, which has proven complicated under DoW contracts.
• Contractors should begin internal discussions now to ensure they have the resources to comply with the FAR CUI Rule.
• Contractors should also ensure their SSPs and POA&M trackers are accurately maintained, in the event the government requests to review them. As shown through recent settlements under the Department of Justice’s Civil Cyber-Fraud Initiative, an inaccurate SSP can generate legal risk.
• Finally, entities should consider submitting comments on the proposed language on or before July 23, 2026, when the public comment period closes. As evidenced by the impact of similar DFARS clauses on the Defense Industrial Base, the final FAR CUI Rule will undoubtedly have a large and lasting effect on all government contractors.