top of page

FAR CUI Rule Proposes NIST 800-171 Rev 3 as the New Standard for Federal Contractors Handling CUI

Sep 23
6 min read

The rules for protecting Controlled Unclassified Information (CUI) are changing again, and this time they reach far beyond the defense industrial base. In June 2026, the FAR Council released an updated CUI proposed rule that standardizes how CUI is identified and flowed down across federal contracts, and, most significantly, makes NIST SP 800-171 Revision 3 the baseline for contractors handling CUI. For any company navigating flow-down requirements, it's the most important development of the year.


How We Got Here


The current framework traces back to August 2015, when DoD issued the updated DFARS 252.204-7012, requiring contractors to implement NIST SP 800-171 to protect Covered Defense Information. The standard became fully effective in December 2017. NIST SP 800-171 was specifically designed as a contractor-appropriate standard, drawing the confidentiality-related controls from the federal agency standard NIST SP 800-53 and tailoring them for non-federal information systems.


The problem that emerged was enforcement. DoD Inspector General audits found that many defense contractors were not meeting their DFARS 252.204-7012 obligations, failing to produce required system security plans and plans of action and milestones, and in many cases not making meaningful progress toward implementation. That enforcement gap led to the creation of the Defense Industrial Base Cybersecurity Assessment Center (DIBCAC) and, ultimately, CMMC: the verification layer designed to confirm that contractors are actually implementing the controls they are required to have.


DFARS 252.204-7012 and NIST SP 800-171 set the requirement. CMMC was designed to verify it. The FAR CUI rule is the next step in extending and standardizing that model across the entire federal government.


Why it Matters


CUI protection is not a compliance exercise. When sensitive defense design data is stolen, adversaries can replicate systems built on years of U.S. research and development investment without bearing the cost of developing them. The requirement to protect CUI exists because the consequences of failing to do so are strategic and irreversible. Every flow-down clause and every CUI marking requirement exists for that reason.


Simply put, if finalized, the FAR CUI rule means that any contractor handling CUI across the federal government, whether for DHS, NASA, DOJ, or any other civilian agency, will face the same NIST SP 800-171 safeguarding, incident reporting, and flow-down obligations that defense contractors have lived with since 2017.


What the Updated FAR CUI Rule Changes


The updated proposed rule, published June 23, 2026 (91 FR 37550), supersedes the January 2025 version and consolidates CUI requirements as part of the broader Revolutionary FAR Overhaul. Here is what contractors need to know:


A standardized CUI form. The rule introduces Standard Form XXX, which contracting officers must complete for every applicable solicitation and contract. The form identifies whether CUI is involved, which categories apply, where it will reside, and the safeguarding and reporting requirements. This creates a uniform mechanism for communicating to contractors exactly what CUI they will handle, replacing the current inconsistent practice of leaving contractors to determine CUI scope themselves.


A new home in FAR Part 40. CUI requirements now live in an expanded FAR Part 40, Information Security and Supply Chain Security, alongside other national security contracting controls. The substantive obligations appear in clauses FAR 52.240-6 and 52.240-7.


72-hour incident reporting. An earlier 8-hour reporting requirement drew significant public comment. The June 2026 version aligns reporting with the 72-hour timeline already established under DFARS 252.204-7012 and the Cyber Incident Reporting for Critical Infrastructure Act of 2022.


Broad applicability. Requirements apply to commercial products and commercial services, with a narrow exception for contracts solely for commercially available off-the-shelf items.


The Headline Change: NIST SP 800-171 Revision 3


The most consequential change is the control standard itself. The current DFARS framework requires NIST SP 800-171 Revision 2. The updated FAR CUI rule requires Revision 3 for contractors whose contracts identify CUI. Contractors handling CUI tied to critical programs or high-value assets may also face enhanced requirements under NIST SP 800-172.


This matters because contractors already compliant with Revision 2 will not automatically be compliant with Revision 3. Revision 3 restructured control families and introduced organization-defined parameters. Companies with mature DFARS 252.204-7012 programs will have a head start, but every contractor handling CUI should assess that gap now rather than waiting for the rule to finalize.


Note that CMMC Level 2 currently remains on Revision 2 under a DoD class deviation. The FAR CUI rule and CMMC are separate tracks. Once the FAR CUI rule finalizes, it will require Revision 3 independent of whatever CMMC requires.


What the Rule Says About Flow-down


Like DFARS 252.204-7012, the FAR CUI rule flows down. Prime contractors must pass CUI safeguarding requirements through every subcontract tier where subcontractors will handle CUI. For a detailed breakdown of how those obligations cascade and what primes are legally responsible for, see Cape's guide to DFARS flow-down requirements. The updated rule gives primes flexibility in how they communicate those requirements; primes are not required to pass the SF XXX itself verbatim, but must ensure the substance of the requirements reaches every applicable sub. Suppliers that handle no CUI, and COTS-only subcontracts, remain outside the scope. (SF XXX is the placeholder designation used in the proposed rule; the form will receive an official number upon finalization)


Under the updated rule, subcontractors report CUI incidents directly to the government rather than through the prime, while also notifying the contracting officer and the next higher tier contractor.


If you are a prime, your flow-down obligations are about to become more explicit and more documented. If you are a subcontractor, the requirements reaching you will be clearer — and the position that you did not know something was CUI becomes significantly harder to sustain.


What Contractors Should Do Now


Get your CUI scope right first. You cannot comply efficiently until you know what CUI you hold and where it lives. Accurate CUI discovery is the foundation of every compliance decision that follows.


Assess the Revision 2 to Revision 3 gap. Identify where the newer standard changes your obligations so you are not caught unprepared when the rule finalizes.


Do not wait. The FAR Council expects to finalize the rule before the end of 2026. Unlike CMMC's phased rollout, there is no anticipated phase-in period once the clauses are inserted into contracts.


Consider a secure enclave. For many contractors, isolating CUI in a purpose-built secure enclave is the most cost-effective path to meeting these requirements without raising an entire environment to the standard.


FAQs


Is the FAR CUI rule final? No. It is a proposed rule. The public comment period closed July 23, 2026. The FAR Council expects to finalize it before the end of 2026 with no anticipated phase-in period once the clauses appear in contracts. Source: Federal Register, 91 FR 37550, June 23, 2026.


Does it require NIST SP 800-171 Revision 3? Yes. The June 2026 rule requires Revision 3 for contractors whose contracts identify CUI, applying DoD's organization-defined parameter values. Contractors handling CUI for critical programs or high-value assets may also face NIST SP 800-172 enhanced requirements. Note that CMMC Level 2 currently remains on Revision 2 under a separate DoD class deviation. Sources: Federal Register 91 FR 37550; DoD CMMC Program FAQ.


Does it apply to commercial contracts? Yes. It applies to contracts for commercial products and commercial services, with a narrow exception for contracts solely for COTS items. Source: Federal Register 91 FR 37550.


How is it different from DFARS 252.204-7012? DFARS 252.204-7012 applies to defense contractors handling Covered Defense Information. The FAR CUI rule extends a standardized CUI framework, including the SF XXX form, across all federal agencies, creating a government-wide approach rather than a defense-only one. Unlike CMMC, the FAR CUI rule includes no third-party assessment requirement, though contractors must make their system security plan and plans of action available to the government on request. Source: Federal Register 91 FR 37550, Original FAR CUI proposed rule, 90 FR 4278, January 15, 2025


What contractors should do now


  • Get your scope right first. You cannot comply efficiently until you know what CUI you hold and where it lives. Accurate CUI discovery is the foundation of every compliance decision that follows.

  • Assess the Rev 2 to Rev 3 gap. Identify where the newer revision changes your obligations so you're not caught flat-footed when the rule finalizes.

  • Do not wait for a phase-in. The FAR Council expects to finalize the rule before the end of 2026, and unlike CMMC's phased rollout, there is no anticipated phase-in period once the clauses are inserted into contracts.

  • Consider an enclave. For many contractors, isolating CUI in a purpose-built secure enclave is the most cost-effective way to meet the requirements without raising an entire environment to the standard.



Sources


Comments

Commenting on this post isn't available anymore. Contact the site owner for more info.
bottom of page