Proposed FAR rule would extend CUI security and 72-hour reporting to civilian contractors

On June 23, 2026, the FAR Council issued a proposed rule creating a government-wide framework for safeguarding controlled unclassified information (CUI) and reporting CUI incidents, Mayer Brown reported. Contractor systems handling CUI would have to meet NIST SP 800-171 Revision 3, and cloud services used for CUI would need protections equivalent to the FedRAMP Moderate baseline. Contractors would report CUI incidents within 72 hours of discovery, up from the eight hours in a January 2025 version, and preserve images of affected systems for at least 90 days. The comment period closed July 23, 2026.

The biggest change is reach. Defense contractors already face similar DFARS rules, but this would apply to civilian agency contracts too, including those for commercial products and services other than off-the-shelf items, and it flows down to subcontractors that handle CUI. National Law Review notes it would use Revision 3 of NIST SP 800-171, while DoD's current approach uses Revision 2, so the two may be temporarily out of step.

If you sell to any federal agency, ask whether your contracts involve CUI. If they do, start a gap assessment against NIST SP 800-171 Rev 3 and confirm whether your cloud email, file storage and backup providers meet FedRAMP Moderate or an equivalent. Write a 72-hour incident reporting procedure now, including who decides that an incident involves CUI. Subcontractors should expect primes to ask about this soon.

No effective date or implementation schedule has been set. Watch for the final rule, which could take effect without a phased rollout.