The FAR CUI Rule: Revision 3 Is Coming for Every Federal Contractor, Not Just Defense

By Josh Hammer

The FAR Council has proposed a government-wide framework for safeguarding Controlled Unclassified Information, or CUI, across federal contracting. If finalized, the framework would point civilian-agency contractors toward NIST SP 800-171 Revision 3 as the baseline for protecting CUI in non-federal information systems.

That would affect more than defense manufacturers and aerospace suppliers. It could reach contractors supporting health, energy, transportation, education, financial regulation, research, facilities, construction, and other civilian missions.

The practical question is not simply, “Do you have a Department of War contract?”

It is this:

Do you handle government information that is not intended for public release and that may require safeguarding controls under law, regulation, or government-wide policy?

That question is only a starting point. The contract, the information involved, the agency’s designation, and the proposed Standard Form requirements ultimately determine whether the CUI framework applies.

Most importantly, this rule is not final.

The FAR CUI Rule Is Still a Proposal

On June 23, 2026, the Federal Acquisition Regulatory Council published FAR Case 2026-001 in 91 FR 37550 as part of the Revolutionary FAR Overhaul. The Federal Register notice identifies the action as a proposed rule.

The public comment period for the main rule closed on July 23, 2026. A separate notice concerning information-collection burden under the Paperwork Reduction Act remained open for comments until August 24, 2026.

The FAR Council has indicated an intent to finalize the broader overhaul before the end of 2026.

However:

• The rule has not been finalized.
• No effective date has been established.
• The proposed FAR 52.240-7 clause is not currently a universal contractual requirement.
• Requirements would become operational when a final rule is issued and applicable clauses are incorporated into specific solicitations and contracts.

That distinction matters. You should not represent that the FAR CUI rule is already in force. You should, however, take the proposal seriously as a strong signal of the direction federal information-security requirements are moving.

As Hunton Andrews Kurth explains, the proposal updates and supersedes the earlier January 2025 CUI proposal. The newer version moves the requirements into a reorganized FAR Part 40 and changes the baseline from NIST SP 800-171 Revision 2 to Revision 3.

Why This Is Bigger Than the CMMC Debate

CMMC is a Department of War program. The FAR CUI proposal is different. It is designed to establish a common federal contracting mechanism that reaches civilian agencies as well as defense-related acquisitions.

Today, civilian contractors can encounter a patchwork of agency-specific requirements. One agency may identify sensitive information through contract language. Another may use a separate policy, supplemental clause, or handling instruction. A third may not communicate the requirements clearly until after performance begins.

The FAR Council’s proposal attempts to create a more uniform process.

The proposed framework would use:

1. A standard form, referred to as SF XXX, to identify the CUI involved in a contract.
2. FAR 52.240-6, Notice of Controlled Unclassified Information Requirements, as a solicitation provision.
3. FAR 52.240-7, Controlled Unclassified Information, as the contract clause establishing safeguarding, reporting, and flow-down requirements.
4. NIST SP 800-171 Revision 3 as the baseline for qualifying non-federal systems handling identified CUI.
5. A 72-hour incident-reporting framework for covered CUI incidents in non-federally controlled facilities.

The result would be a shared federal baseline where many civilian contractors have historically operated under fragmented requirements.

That does not mean every federal contractor would automatically be subject to NIST SP 800-171 Rev. 3. The proposed clause would apply when the contract identifies CUI and incorporates the relevant requirements. But it does mean that “we are not a defense contractor” would no longer be a reliable reason to dismiss NIST SP 800-171.

CUI Is Not the Same as FCI

Before discussing Revision 3, you need to separate two terms that are often incorrectly treated as interchangeable: Federal Contract Information, or FCI, and CUI.

FCI generally refers to information provided by or generated for the government under a contract that is not intended for public release. CUI is narrower and more formal. It is information that the government creates or possesses, or that an entity creates or possesses on behalf of the government, and that a law, regulation, or government-wide policy requires or permits an agency to handle with safeguarding or dissemination controls.

A contractor may handle:

• FCI but not CUI.
• CUI and FCI.
• Neither.
• Different categories of information under different contracts.

The proposed FAR framework treats these categories differently. The CUI clause points to NIST SP 800-171 Rev. 3 for non-federal systems handling identified CUI. FCI is addressed through a separate proposed covered-information framework and should not be casually folded into the CUI analysis.

For a practical starting point, review H&V’s CMMC FAQ and the related internal resource, Technical Guide #3: How to Determine Whether You Handle FCI or CUI. The central lesson is simple: classification should follow the contract, the data, and the governing authority, not assumptions based on your industry label.

What Revision 3 Changes for a Contractor Starting From Zero

A civilian contractor that has never implemented NIST SP 800-171 may look at Revision 3 and see a familiar list of cybersecurity topics: access control, authentication, incident response, audit logging, configuration management, and system integrity.

That surface similarity is misleading.

Revision 3 changes the structure of the framework in several important ways:

• Revision 2: 110 requirements across 14 families.
• Revision 3: 97 requirements across 17 families.
• Revision 3 adds the Planning, System and Services Acquisition, and Supply Chain Risk Management families.
• Revision 3 introduces organization-defined parameters, or ODPs.
• The revision is more closely aligned with NIST SP 800-53 Revision 5 and its control architecture.

The reduction from 110 to 97 does not mean the framework is automatically easier. A lower requirement count can conceal a more deliberate implementation burden. Some requirements were consolidated, reorganized, or rewritten. Other expectations were moved into new families or expressed through parameters that the organization must define.

The New Families Are Operationally Important

The new families are particularly relevant to civilian contractors that have historically treated compliance as a documentation exercise.

Planning requires the organization to think about security planning as an operating function. That includes defining the system, establishing security plans, identifying responsibilities, and maintaining the documentation necessary to understand how controls are implemented.

System and Services Acquisition brings security considerations into procurement and service selection. This matters when your CUI environment depends on cloud providers, managed service providers, software vendors, subcontractors, or specialized facility systems.

Supply Chain Risk Management recognizes that your security boundary does not end at your firewall. A contractor can have strong internal controls and still inherit risk through suppliers, software dependencies, remote-access vendors, or subcontractors that can access CUI.

Organization-Defined Parameters Add Specificity

Many Rev. 3 requirements use organization-defined parameters. These parameters allow the organization, or, in this proposal, the government’s specified values, to define details such as:

• How quickly an event must be reported.
• How often a review must occur.
• Which systems, users, or assets are included.
• How long records must be retained.
• What threshold triggers additional action.

An ODP is not a substitute for implementation. It is a decision that makes a requirement concrete.

For example, “review privileged access periodically” is not an operational control until the organization defines who performs the review, which accounts are included, how frequently the review occurs, what evidence is retained, and what happens when inappropriate access is discovered.

This is why starting with the right structure matters. If you build a program around a vague interpretation of Revision 2 and attempt to retrofit Revision 3 later, you may have to rewrite policies, reassign ownership, expand evidence collection, and redesign supplier processes.

A proper Rev. 3 program begins with the system boundary, the information flows, the contract, the applicable ODPs, and the evidence model.

Flow-Down Applies Across the Supply Chain

The proposal would require prime contractors to flow down the substance of FAR 52.240-7 to subcontractors at any tier when the subcontractor will have access to, or the ability to access, CUI identified in the SF XXX.

This is one of the most important parts of the rule for civilian contractors.

The obligation is not limited to a first-tier subcontractor. It can reach a lower-tier provider that:

• Hosts a system containing CUI.
• Provides managed IT or cybersecurity services.
• Supports a federal project through a shared collaboration platform.
• Performs engineering, design, maintenance, or operational services.
• Has credentials or technical access that could reach identified CUI.

The prime contractor must communicate the substance of the clause and the applicable information from the SF XXX so the subcontractor understands what CUI is relevant to its work.

This creates a supply-chain management problem, not merely a contract-administration problem. Primes will need to identify which subcontractors can access CUI, understand what systems those subcontractors use, verify that flow-down language is present, and maintain evidence that the relationships are being managed.

What About Commercial Products and Services?

The proposed rule would apply the CUI flow-down requirement to contracts and subcontracts for commercial products and commercial services.

There is a narrow exception for contracts solely for commercially available off-the-shelf, or COTS, items.

That exception should not be overread. A commercial service is not automatically a COTS item. A company providing a commercial service that involves access to identified CUI could still fall within the proposed flow-down structure.

As Mayer Brown’s analysis notes, the proposal’s reach across commercial acquisitions is a major reason non-defense businesses should examine their federal contract portfolios now.

Incident Reporting, SAM, and Supply Chain Security

The proposed CUI framework is not limited to technical controls.

For CUI in a non-federally controlled facility, the proposal would generally require a covered incident to be reported within 72 hours of discovery. DoD-related reporting would use the DIBNet portal. Non-DoD reporting would go to CISA, with notice to the contracting officer and, where applicable, the next higher-tier contractor.

The proposal also addresses:

• Preservation of system images and relevant monitoring data.
• Follow-up reporting when more information becomes available.
• Reporting conflicts between the clause and another law or regulation.
• Cloud services handling CUI.
• FedRAMP Moderate-equivalent security requirements for applicable cloud services.
• SAM registration and maintenance.
• Security prohibitions and supply-chain restrictions consolidated in proposed FAR Part 40.

The Inside Government Contracts analysis of proposed FAR Part 40 describes the broader consolidation of information-security and supply-chain requirements.

The proposal also reflects a broader policy direction: contractors will be expected to understand their information environment, suppliers, cloud dependencies, and reporting responsibilities before an incident occurs.

Compliance Tools Are Not the Compliance Process

This distinction deserves emphasis.

A compliance platform can map controls, request evidence, monitor integrations, assign remediation tasks, and produce useful reporting. It cannot determine your legal obligations by itself. It cannot define your CUI boundary without accurate input from your organization. It cannot turn an unimplemented control into an implemented one.

Before selecting a solution, conduct an audit of your current state and build a plan.

At minimum, your first phase should answer:

1. Which federal contracts and subcontracts are relevant?
2. What information do you receive, create, store, process, and transmit?
3. Is the information FCI, CUI, or another protected category?
4. Which systems, facilities, cloud services, and vendors can access it?
5. Which NIST SP 800-171 Rev. 3 requirements apply?
6. Which ODPs and agency-specific requirements must be addressed?
7. Which controls exist in practice, and which exist only on paper?
8. Which gaps create the greatest operational or contractual risk?
9. Who owns remediation?
10. What evidence will demonstrate that the control is operating?

Only after answering those questions should you compare tools.

H&V’s article “Compliance Tools Are Not a Compliance Program” explains this principle in greater depth. The tool should support the process, not become a substitute for it.

Where H&V Complynt Fits

H&V Complynt is an enterprise compliance automation platform designed to support the operational work after scope and obligations have been established.

The platform supports:

• Automated control mapping.
• Evidence collection.
• Continuous compliance monitoring.
• Remediation tracking.
• Pre-built content packs.
• Policy-as-code.
• Cross-framework visibility across more than 150 standards.

Supported frameworks include CMMC, NIST SP 800-171, NIST SP 800-53, RMF, SOC 2, HIPAA, ISO 27001, and others.

The goal is to help organizations maintain one control environment and reuse evidence where requirements genuinely overlap. That is the practical meaning of “map once and satisfy many.” It does not mean that every framework is identical or that one dashboard creates compliance. It means a properly designed control can be mapped across multiple obligations without rebuilding the same evidence process from scratch.

Complynt runs on FedRAMP High and DoD IL5 authorized infrastructure on Palantir’s federal cloud. The authorization status of the hosting environment is not the same as an authorization or certification of your organization; deployment suitability still depends on the relevant agency, system boundary, and authorization process.

H&V is also EDWOSB certified.

H&V does not issue certifications and cannot guarantee an assessment outcome. A readiness platform or advisory engagement is not a government authorization, independent assessment, or certification decision.

What Civilian Contractors Should Do Now

Because the rule is proposed, you do not need to treat every provision as an immediate final obligation. You should treat the proposal as a planning signal.

A sensible preparation sequence is:

1. Review your federal contract portfolio. Identify civilian-agency contracts, task orders, subcontracts, and upcoming bids.
2. Inventory government information. Document where it enters your environment and who can access it.
3. Separate FCI from CUI. Do not assume that all non-public government information is CUI, but do not assume that civilian information is outside the CUI program.
4. Map the likely Rev. 3 delta. Compare current practices with the 97-requirement, 17-family structure.
5. Review suppliers and subcontractors. Identify every party with access or the ability to access identified CUI.
6. Evaluate cloud architecture. Determine whether cloud providers and services can support the proposed requirements.
7. Prepare incident-response workflows. Confirm that your team can identify, escalate, document, and report a potential CUI incident within the proposed timeline.
8. Build a prioritized remediation plan.
9. Select automation only after the audit and planning work.

This preparation is useful even if the final rule changes. Strong scoping, evidence management, supplier governance, and incident response are not wasted work.

Read Next in This Series

• Start with the free H&V readiness check
• Review the CMMC FAQ for background on FCI, CUI, scope, and assessment terminology
• Read H&V’s related working materials: NIST 800-171 Rev. 2 vs. Rev. 3: The Control Delta Nobody Has Mapped, The Definitive Guide to Controlled Unclassified Information (CUI), Technical Guide #3: How to Determine Whether You Handle FCI or CUI, and One Control Environment: Why Your SOC 2 Evidence Should Already Be Your CMMC Evidence.

Frequently Asked Questions

Is the FAR CUI rule final?

No. FAR Case 2026-001 is a proposed rule published June 23, 2026, at 91 FR 37550. The main comment period closed July 23, 2026. No effective date has been established.

Does the proposal apply only to defense contractors?

No. It is designed to create a government-wide CUI framework that extends to civilian-agency contracts. It would apply when a contract identifies CUI and incorporates the applicable requirements.

Does every federal contractor have to implement NIST SP 800-171 Revision 3 now?

No. The proposal is not currently in force. If finalized, contractors operating non-federal systems that handle CUI identified in covered contracts would generally need to implement the applicable Rev. 3 requirements and agency-specified parameters.

What is the difference between FCI and CUI?

FCI is non-public information provided by or generated for the government under a contract. CUI is information subject to safeguarding or dissemination controls under law, regulation, or government-wide policy. They are distinct categories and should not be conflated.

Does the proposed rule flow down to subcontractors?

Yes. Proposed FAR 52.240-7 would require the substance of the clause and applicable CUI information to flow down to subcontractors at any tier that will access, or have the ability to access, identified CUI.

Is there an exception for commercial products and services?

The proposal would apply to commercial products and commercial services, with a narrow exception for contracts solely for commercially available off-the-shelf items.

Is this the same as CMMC?

No. CMMC is a separate Department of War program. As of this writing, CMMC Phase II third-party assessments are paused. The proposed FAR CUI framework is a separate government-wide rulemaking effort.

Can a compliance platform guarantee that my organization will pass an assessment?

No. H&V does not issue certifications and cannot guarantee any assessment outcome. Automation can support evidence, mapping, monitoring, and remediation, but the compliance process still requires accurate scope, implemented controls, operating evidence, and independent or government review where applicable.

The first step is not buying a tool. It is understanding what information you handle, where it resides, which obligations apply, and what must change.

Take the free H&V Complynt readiness check to establish a directional view of your current posture and identify priority gaps. The readiness check is for planning; it is not an official assessment, certification, audit, legal opinion, or guarantee of compliance.