On January 15, 2025, the Federal Acquisition Regulation (“FAR”) Council proposed a new FAR Controlled Unclassified Information (“CUI”) rule (“proposed rule”) to establish uniform requirements for handling CUI with broad applicability to solicitations and contracts across the federal government.
The proposed rule, in development for roughly a decade, represents a significant step in the government’s long running trend towards increasing the required protections around sensitive information that contractors receive or generate during performance of their contracts. If finalized, the rule would help standardize the patchwork of cybersecurity requirements that contractors currently face across the Executive Branch and expand the scope of contracts, and companies, that have obligations to protect CUI in accordance with these requirements. As a consequence, some companies that previously were not subject to significant cybersecurity obligations could soon have to make the same types of investments that defense contractors have been required to make to perform work on certain contracts.
Likewise, although the rule could cause some uncertainty in terms of the precise scope of information that companies may be required to protect, the rule will likely bring greater certainty around the contracts where CUI – and the accompanying protection obligations – will be present. Specifically, the new requirement for a standard form, Standard Form (“SF”) XXX, CUI Requirements, that will identify the categories of CUI that require protections under any particular contract, and the use of a clause that is to be included only in those contracts where CUI is expected means that companies would have a clearer view in advance of entering into an agreement as to whether the requirements will apply to the particular contract. As discussed below, that clarity will depend in part on the government doing its part to clearly identify the information that is CUI, which has been challenging up until now.
Key Takeaways
At a high level, the proposed rule would add three new FAR clauses and a new FAR provision establishing contractor requirements for handling CUI in federal solicitations and contracts. As noted, the proposed rule would also create a new standard form, SF XXX, that requires the acquiring agency to identify whether the contractor is expected to collect, develop, receive, transmit, use, handle, or store CUI under the contract, the categories of CUI that will be involved in the performance of the contract, the contractor information systems on which such CUI will reside, and the requirements for collecting, developing, receiving, transmitting, using, handling, or storing such CUI, as well as for reporting incidents involving CUI. The proposed rule also includes definitions of critical terms such as “CUI”, “CUI incident”, and “covered federal information” (“FCI”).[1]
We outline four key takeaways of the rule below:
Broad Applicability
The purpose of the rule is to implement uniform, governmentwide policies and procedures for federal agencies and contractors to handle CUI. Accordingly, the proposed rule has broad applicability to all federal procurement solicitations and contracts subject to the FAR, with a limited exception for solicitations or contracts solely for the acquisition of Commercially Available Off-the-Shelf (“COTS”) items. Thus, if finalized, the proposed rule would apply to contracts for commercial products and commercial services as well as contracts at or below the Simplified Acquisition Threshold.
The proposed rule would impose two different sets of information security requirements depending upon whether the CUI is located within a federally controlled facility or a non-federally controlled facility. For CUI located within a federally controlled facility, the proposed rule would require the contractor to follow agency policies and to ensure that any contractor employees handling CUI within the facility meet the training and access requirements identified in the proposed SF XXX. For CUI located within a non-federally controlled facility (except for “Federal information systems” identified on the SF XXX, which are subject to NIST SP 800-53 and other requirements specified on the SF XXX), the proposed rule would require the contractor to comply with the requirements of NIST SP 800-171 Revision 2 and any additional controls that the SF XXX specifies, and also to implement additional security requirements that the contractor “reasonably determines [are] necessary to provide adequate security in a dynamic environment.” The NIST 800-171 requirements for CUI located within non-federally controlled facilities and within non-Federal information systems closely track the existing Department of Defense (“DoD”) requirements for safeguarding covered defense information and cyber incident reporting under DFARS 252.204-7012 (e.g., NIST SP 800-171 security controls for contractor information systems that contain CUI and FedRAMP Moderate or equivalent requirements for the contractor’s cloud service providers that have CUI on their systems). However, the proposed rule would not replace these existing DFARS 7012 requirements.
Identifying CUI
The proposed rule would create a new form, SF XXX, to promote uniform implementation of CUI requirements. SF XXX would establish a standard means for agencies to identify the CUI categories that require safeguarding, the applicable safeguarding and marking requirements, and the contractor’s reporting obligations in the event of a CUI incident. If the contractor’s performance of the contract will involve CUI, the agency requiring activity would have to identify the CUI categories that will be involved and prepare and include the SF XXX in federal government solicitations and contracts that may result in handling of CUI under FAR 52.204-XX. Prime contractors would also be responsible for flowing down CUI requirements to subcontractors by including their own SF XXX in subcontracts. Contractors are only required to safeguard the CUI identified in the new SF XXX, except for certain categories of unmarked or mismarked CUI (see discussion below).
If the contract does not involve CUI, the agency would incorporate FAR 52.204-YY, Identifying and Reporting Information That is Potentially CUI, in the solicitation or contract. Under this clause, if the contractor identifies unmarked or mismarked CUI or CUI not included in the SF XXX, contractors must notify the contracting agency within 8 hours of identification. These requirements are discussed further below in the section on Unmarked, Mismarked, or Misidentified CUI below.
CUI Incidents
The proposed rule also provides new guidance on how to handle CUI incidents. For incidents involving CUI located at federally controlled facilities, agency guidance on incident reporting would apply. For incidents involving CUI located at non-federally controlled facilities (other than on Federal information systems), the contractor must report the incident or suspected incident within 8 hours of discovery in accordance with the proposed rule. The proposed rule defines incidents broadly to include any form of “improper access, use, disclosure, modification or destruction of CUI.” After reporting an incident or suspected incident, the contractor would have to preserve and protect images of all known affected information systems and all relevant monitoring and packet capture data. The preserved information should be retained for 90 days from the submission of the CUI incident report unless the government provides otherwise. FAR 52.204(g)(4). These requirements would need to be flowed down to subcontractors, who must notify the entity under which they directly contract within 8 hours of discovery. Other applicable reporting requirements specific to a particular contract (e.g., additional provisions specified in the contract, FedRAMP reporting requirements) continue to apply.
Unmarked, Mismarked, or Misidentified CUI
The proposed rule provides guidance on unmarked, mismarked, or misidentified CUI not included in the SF XXX. The proposed rule clarifies that the presence or disclosure of unmarked, mismarked, or misidentified CUI is not considered a CUI incident, unless a lack of marking has resulted in the mishandling or improper dissemination of information. FAR 4.403-6(d)(3). During the solicitation phase or performance of the contract, the prospective offeror or contractor would be requested (if a solicitation) or required (during performance) to notify the contracting agency within 8 hours if it discovers unmarked or mismarked CUI or CUI that is not listed on the SF XXX. The proposed rule states that contractors are responsible for safeguarding CUI that is unmarked, mismarked, or misidentified until the Contracting Officer makes a determination as to its status. FAR 4.303-4. However, the proposed rule states that contractors are not required to mark or identify unmarked, mismarked, or misidentified CUI unless doing so is specifically required by the SF XXX, such as when the contractor generates or develops the CUI.
After the contractor has identified mismarked or unmarked CUI, the proposed rule outlines specific actions that the agency must take to remedy the mistake. If the agency decides it would prefer the contractor to handle this kind of CUI during the performance of the contract, the contracting officer can update the SF XXX, create a new SF XXX, if needed, and/or consider any request for equitable adjustment submitted by the contractor.
Request for Comments
In its request for comments by March 17, the FAR Council indicated a particular interest in the proposed rule’s reporting requirements related to other federal government reporting requirements and how contractors would handle disparate incident reporting timelines, particularly given the iterative nature of investigating and reporting on incidents. In addition, the FAR Council requested comment on concerns related to “CUI specified,” i.e., CUI that is subject to reporting requirements under the proposed rule as well as additional, more specific requirements based on other laws, regulations, and policies, and potentially disparate handling requirements.
[1] The proposed rule would define CUI consistent with 32 C.F.R § 2002.4 as “information that the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls.”