New ISOO Guidance Directs Federal Agencies to Provide More CUI Guidance to Contractors

On September 2, 2026, the National Archives and Records Administration (NARA), through its Information Security Oversight Office (ISOO), released two new Notices on the topic of Controlled Unclassified Information (CUI): ISOO Notices 2026-07 and 2026-08. 

CUI is a category of information that the federal government creates or possesses, or that an entity creates or possesses for or on behalf of the federal government, that requires safeguarding or dissemination controls but is not classified, per 32 CFR 2002.4(h).  Federal government contracts often require contractors to implement heighted cybersecurity and physical security controls to safeguard CUI.  Federal agencies are supposed to tell their contractors which contract-relevant information is CUI. In practice, however, contractors often find it difficult to determine what constitutes CUI.  Additionally, contractual requirements for safeguarding and handling CUI often vary across programs and agencies, with inconsistent and sometimes unclear identification processes. 

ISOO Notice 2026-07, Executive Agent Guidance for Implementation of the Controlled Unclassified Information Program, seeks to address some of these challenges.  Neither this Notice nor its companion Notice regarding CUI waivers (2026-08) directly addresses or applies to contractors—both apply to federal agencies—but they may nevertheless benefit contractors. 

Significantly, ISOO Notice 2026-07 instructs agencies, “[f]or all contracts requiring access to CUI,” to provide, at a minimum, the following guidance to prime contractors: 

• Identification of Specific Government-Furnished Information Designated as CUI; 
• Process for identification of Contractor Developed Information as CUI; 
• Process for CUI challenges; 
• Training requirements and resources; 
• Access requirements; 
• Marking requirements; 
• Safeguarding requirements; 
• Decontrol and disposition requirements; 
• Reporting requirements; 
• Self-Inspection requirements; 
• Process for reporting misuse of CUI; and 
• Penalties for misuse of CUI. 

ISOO Notice 2026-07 provides additional detail on several of these items.  For example, the Notice instructs agencies to decontrol CUI in a timely manner when it no longer requires protection and to “include the identification of a specific decontrolling date or event with all CUI.”  It also requires agencies to implement processes for the timely communication of CUI challenge decisions (i.e., decisions resolving challenges to CUI status). 

Takeaways for Federal Government Contractors 

This guidance is the latest indication that the government is seeking to make strides in more clearly communicating CUI handling requirements to their contractors.  Earlier this summer, the FAR Council release an updated draft of the much-anticipated “FAR CUI Rule,” which calls for a new Standard Form that would itemize all CUI expected to be handled in contract performance.  While comments on the proposed rule are considered, the new Notices could serve as an immediate step toward clearer CUI expectations in contracts.  As federal agencies begin to implement this guidance, contractors should consider affirmatively requesting the information it outlines.  Obtaining this clarity in writing at the outset of a contractual relationship can help establish clear compliance obligations and minimize the risks of over- or under-protecting CUI.