FAR Council Proposes Government-Wide CUI Rule Adopting NIST SP 800-171 Rev 3
As part of the Revolutionary FAR Overhaul, the FAR Council issued a revised proposed rule (FAR Case 2026-001, 91 FR 37550) that consolidates Controlled Unclassified Information safeguarding into a reorganized FAR Part 40, Information Security and Supply Chain Security. The proposal would require contractor systems handling CUI identified on a new standard form to implement NIST SP 800-171 Revision 3, with DoD-published Organization-Defined Parameter values, and to report CUI incidents within 72 hours of discovery. It replaces the January 2025 FAR Case 2017-016 proposal; the comment period closed July 23, 2026, and the rule is not final as of August 2026.
Key Analytics
Impact Analysis
If finalized, this proposed rule would extend a NIST SP 800-171 Rev 3 baseline to CUI-handling contractors across all federal agencies, not just the Department of Defense, pulling civilian-agency contractors into obligations that previously resembled DFARS-only territory. That creates a dual-baseline problem: CMMC assessments remain anchored to Rev 2's 110 practices while the proposed FAR clause points to Rev 3, so defense contractors would need to track both until the programs converge. The 72-hour incident reporting window, lengthened from the 8-hour timeline in the January 2025 proposal, aligns with DFARS 252.204-7012, but reporting destinations differ by agency (DIBNet for DoD contracts, CISA for civilian contracts). Contractors and subcontractors receiving CUI should treat the comment-period close as the signal to begin readiness work rather than waiting for the final rule.
Recommended Actions
- Run a gap assessment against NIST SP 800-171 Rev 3, including the DoD-published Organization-Defined Parameter values, while maintaining Rev 2 compliance for CMMC purposes
- Update incident response plans to support a 72-hour CUI incident reporting clock, with the correct destination pre-identified (DIBNet for DoD contracts, CISA for civilian-agency contracts) and contracting officer notification steps documented
- Inventory where CUI enters, resides, and flows in your environment so you can scope in-boundary systems quickly once the standard form begins identifying CUI on contracts
- Review subcontract templates for CUI flowdown, since the proposal requires subcontractors handling CUI to meet the same safeguarding requirements and report incidents directly to the government
- Monitor FAR Case 2026-001 for the final rule and reconcile any divergence between the finalized FAR CUI clause and CMMC program requirements before bidding on affected solicitations
Always verify requirements with official regulatory sources.
Estimated Remediation Effort
Indicative effort to address this development, broken down by your organization's current compliance posture. Select the posture that best matches where you are today.
A partial program exists: some policies and controls are in place, but coverage, evidence, and ownership have gaps.
- ›Rev 3 delta assessment against the existing Rev 2 implementation held for CMMC
- ›Incident response runbook update for the 72-hour clock and the correct agency destination
- ›CUI data flow mapping to speed scoping once the standard identification form appears
The Cost of Waiting
Readiness work is dramatically cheaper before a deadline than after one. The ranges below come from the same estimate: the difference is only how prepared you are when the work starts.
Roughly 50 to 120 hours avoided by preparing early
Effort ranges are indicative planning estimates, not quotes. Actual effort depends on organizational scope, environment complexity, and evidence maturity. Talk to us for a scoped assessment.