A proposed rule would set the same CUI rules for all federal contracts

Checked on 8 October 2026.

What happened

The FAR (Federal Acquisition Regulation) is the rulebook for federal contracts. On 23 June 2026 the FAR Council, which writes it, published a proposed rule in the Federal Register. The council includes the Department of War (the new name of the Department of Defense).

The proposal, part of an overhaul of the FAR, would add rules for CUI (Controlled Unclassified Information: sensitive government information your contract marks or describes, such as drawings, specifications or technical data) to Part 40 of the FAR. Comments closed on 23 July 2026.

It has three new pieces:

Piece What it would do
A notice in the request for bids (FAR 52.240-6) A bidder that does not meet every requirement would list the gaps in its offer, with a plan of action and milestones (a written plan for fixing what is still missing, with dates).
A contract clause (FAR 52.240-7) How you protect CUI, report problems and pass the rules down to subcontractors that handle it.
A new standard form (SF XXX in the proposal) The agency says whether the contract involves CUI, which kinds, and how to mark it. You would protect only the CUI it names, and tell the contracting officer within 72 hours if you find CUI it does not name or that is not marked.

The clause would ask a company that keeps CUI on its own computers to:

  • Meet NIST Special Publication (SP) 800-171 Revision 3, the security requirements for CUI from NIST (the National Institute of Standards and Technology). Set values from a Department of War list would fill in the choices Revision 3 leaves open.
  • Use a cloud service for CUI only if it meets security equal to the FedRAMP Moderate baseline. FedRAMP is the government’s security program for cloud services.
  • Report a CUI incident within 72 hours of discovery: on defense contracts to the Department’s reporting site, on others to CISA (the Cybersecurity and Infrastructure Security Agency). Then tell the contracting officer and, if you are a subcontractor, the company above you.
  • Show its SSP (System Security Plan: your document describing your systems and how you meet each requirement) to the government when asked.

What it means for you

This is a proposal. Its clause and form are not in effect, and they can change. The FAR overhaul’s current Part 40 has no CUI section.

  • If you also work for civilian agencies, we think this matters most to you. The proposal says agencies now use their own CUI policies. It would set one approach, built on Revision 3.
  • If you work only for the Department of War, your CUI rules today come from the clause DFARS 252.204-7012 (DFARS: the Defense Federal Acquisition Regulation Supplement, the Department’s own contract rules). Under it, the Department asks for Revision 2. On CUI, the proposal names defense contracts only to say where their incident reports go, and that clause only to say its 72-hour deadline lines up with it. It does not say how the two clauses would sit side by side.
  • If your work involves no CUI, you would get no form and no clause.

What comes next

The FAR Council will consider the comments in writing a final rule. When, and what it will say, is not known as of 8 October 2026.

What to do now

  1. List your contracts and bids by agency, and note which involve CUI.
  2. If you have civilian agency work with CUI, read the proposed clause 52.240-7 with your IT provider.
  3. For your defense work, keep working to Revision 2. That is what DFARS 252.204-7012 asks for today.
  4. We suggest waiting for the final rule before you change your systems for it.

Sources