FAR CUI Rule 2026: What the Revised Proposed Rule Would Require

2026 FAR proposal analysis and contractor action guide — from The Defense Compliance Report

By The Defense Compliance Report Editorial Team · Last reviewed July 2026 · Last verified July 16, 2026

The FAR CUI rule 2026 is not a final rule, and it is not binding. FAR Case 2026-001, published June 23, 2026 at 91 FR 37550, is a revised proposal open for comment through July 23, 2026. If finalized close to how it reads today, it would add clauses FAR 52.240-6 and FAR 52.240-7, a new Standard Form (SF XXX), NIST SP 800-171 Revision 3, 72-hour incident reporting, and subcontract flow-down for federal contracts involving Controlled Unclassified Information (CUI) — reaching civilian-agency contractors, not just DoD.

Here’s the part most pages bury: nothing in this proposal changes your contract the moment it was published. What binds you today is the clause set actually written into your solicitation or contract. That single distinction — proposed versus binding — is the reason this page exists. We read the 85-page Federal Register document, checked the docket, and cross-checked every requirement against the current FAR, DFARS, and 32 CFR Part 170 as of July 16, 2026.

What applies now vs. what is only proposed

Before anything else, orient yourself. This is the whole board on July 16, 2026:

Who this page is for:federal prime contractors and subcontractors who handle — or might be asked to handle — CUI; civilian-agency contractors trying to figure out if this reaches them; and dual defense-and-civilian contractors reconciling a FAR that points to Revision 3 with a CMMC program that still points to Revision 2. CISOs, IT directors, compliance managers, facility security officers, contracts officers, and program managers.

Who it isn’t for:anyone who wants to be told the proposal is already binding (it isn’t), anyone in the middle of a live security incident (call your incident-response plan and counsel), and anyone shopping for a “best CMMC vendor” ranking (we don’t publish those).

What is the FAR CUI rule 2026 — and is it final?

The FAR CUI rule 2026 is a revised proposedgovernmentwide framework — FAR Case 2026-001 — for identifying, safeguarding, and reporting incidents involving Controlled Unclassified Information in federal contracts.It was published June 23, 2026 at 91 FR 37550, and it is not a final rule; publication alone does not make FAR 52.240-6 or FAR 52.240-7 binding contract requirements. Comments close July 23, 2026.

Since Executive Order 13556 created the governmentwide CUI Program in 2010, federal law, regulation, and governmentwide policy have required CUI protections — but agencies have lacked one standard FAR mechanism for identifying and communicating those requirements to contractors. DoD built the most mature defense-specific contract framework, through DFARS clause 252.204-7012 and later the CMMC program. Civilian agencies used varying agency-specific clauses and procedures. FAR Case 2026-001 proposes a uniform mechanism for the entire federal government. For background on what counts as CUI vs. Federal Contract Information, see our FCI vs. CUI guide.

What “proposed rule” means for you

A proposed rule is the government showing its hand and asking for comment before it commits. It tells you where the FAR Council intends to go. It does not amend your contract. A final rule could keep this framework, revise it, renumber the clauses, delay it, or drop pieces of it. Treat the proposal as high-quality planning intelligence— not as a clause you have to comply with tomorrow.

The dates that matter

Primary sources: Federal Register (91 FR 37550, doc 2026-12559); 32 CFR 170.3(e); DoD Class Deviation 2026-O0025.

What still applies today

• ▸The FAR and agency clauses actually written into your solicitation or contract.
• ▸DFARS 252.204-7012(Safeguarding Covered Defense Information and Cyber Incident Reporting) where it’s included — including its existing 72-hour “rapidly report” requirement.
• ▸The current DoD assessment clause.For legacy contracts, DFARS 252.204-7019 and 252.204-7020 may still govern. For solicitations on the DoD Class Deviation 2026-O0025 path (effective February 1, 2026), the deviation uses DFARS 252.240-7997, NIST SP 800-171 DoD Assessment Requirements, and FAR 52.240-93. Verify the actual clause set and contract vintage.
• ▸Current CMMC Phase 1self-assessment requirements — Level 1 (Self) and Level 2 (Self) — where an applicable solicitation, contract, modification, or flow-down includes them.
• ▸Any agency-specific CUI clauses or instructions already in force on your work.

When would the FAR CUI rule take effect?

There are four milestones people routinely blur. Keep them straight:

1. Proposal published — done (June 23, 2026).
2. Comment deadline — July 23, 2026.
3. Final rule published — not scheduled.
4. Effective date + insertion into a solicitation or contract — not scheduled.

Right now, the marker sits between steps 1 and 2. What to watch after July 23: docket activity, the final rule, any clause renumbering, the permanent SF number, and any phased implementation schedule. We won’t pretend to know the timing.

What changed between the 2025 and 2026 FAR CUI proposals?

The June 2026 proposal is a material rewrite of the January 2025 version, not a reprint.It moves the framework into FAR Part 40, changes the proposed incident-reporting clock from 8 hours to 72 hours, adopts NIST SP 800-171 Revision 3 instead of Revision 2, deletes the standalone “potential CUI” clause, narrows the definition of a reportable incident, and revises the training, cloud, and flow-down mechanics.

Plenty of pages still describe the January 2025 draft — Revision 2, an eight-hour reporting window, the old clause numbers — as if it were current. It isn’t. Below is our 2025 → 2026 Change-and-Action Ledger, verified July 16, 2026 against both Federal Register proposals.

Source: Verified July 16, 2026 against 91 FR 37550 (June 23, 2026) and 90 FR 4278 (Jan. 15, 2025).

Who would the FAR CUI rule apply to?

If finalized close to the current draft, the framework would apply when a federal solicitation or contract is expected to involve CUI and the agency marks “Yes” on the new SF XXX.It would not apply where performance involves no CUI. Proposed FAR 52.240-7 excludes acquisitions solely for commercially available off-the-shelf (COTS) items — but other commercial products and commercial services can be covered, and flow-down reaches any subcontract tier that needs access to the identified CUI.

The key shift in mindset: applicability is driven by contract performance, not by who you are.

• Being a federal contractor doesn’t automatically put every system under proposed FAR 52.240-7.
• Being a civilian-agency contractor doesn’t exempt you — that’s the entire point of a “governmentwide” rule.
• The trigger is expected CUI involvement plus incorporation into the contract. Then your actual systems, facilities, cloud services, and subcontracts determine the operational scope.

Which profile are you?

The contract-first test

When someone asks whether the FAR CUI rule “applies to us,” run these five questions before you answer:

1. Is CUI expected in performance?
2. What does the SF XXX say (or, today, what does the contract/agency policy say)?
3. Where will the CUI reside or transit?
4. Which systems and providers can access it?
5. Which clause — and which NIST revision — is actually incorporated?

What FAR 52.240-6, FAR 52.240-7, and SF XXX would actually require

The proposed framework has three moving parts: SF XXX would tell the parties what CUI and contract-specific requirements are in play; FAR 52.240-6 would notify offerors and require them to disclose known compliance gaps; and FAR 52.240-7 would set the contractor’s safeguarding, incident-reporting, conflict-notification, and flow-down duties. None is a final, binding FAR-wide requirement today.

SF XXX — the contract-level CUI map

Under the proposal, the requiring activity (the government) — not the contractor — decides whether a contract involves CUI and completes a new Standard Form, SF XXX (Controlled Unclassified Information Requirements). It’s expected to identify the CUI categories involved, whether the information is CUI Basic or CUI Specified, where it resides (federal or nonfederal systems), who’s responsible for marking, any Organization-Defined Parameters (ODPs), any selected enhanced (NIST SP 800-172) requirements, incident-reporting instructions, and additional contract-specific requirements.

This is the proposed answer to the loudest complaint from the DIB for years: “the government won’t tell me what’s actually CUI.” The SF XXX is a uniform form that’s supposed to say so, up front.

FAR 52.240-6 — Notice of CUI Requirements (the solicitation side)

This is the pre-award provision. It would appear in solicitations that carry FAR 52.240-7 and put offerors on notice of the CUI requirements. Two duties to flag for your capture and proposal teams:

• The proposal says an offeror should notify the contracting officer, generally within 72 hours, of apparent unmarked, mismarked, missing-from-SF, or incident-involved CUI, and should safeguard it pending a determination.
• An offeror that cannot meet an applicable requirement mustidentify each gap and submit a POA&M with its offer (proposed 52.240-6(d)).

Those two modalities — should for the discrepancy notice, mustfor the POA&M — are not the same thing. Don’t let anyone collapse them.

FAR 52.240-7 — Controlled Unclassified Information (the contract side)

This is the operational clause that would live in the awarded contract. It covers CUI identification and discrepancy reporting; the split between federal and nonfederal environments; the NIST SP 800-171 Revision 3 baseline and its ODPs; any CUI Specified or selected NIST SP 800-172 requirements; the cloud baseline; SSP and external-service-provider identification; POA&Ms available to the government on request; incident reporting and evidence preservation; conflict-of-law notification; and subcontract flow-down.

The proposed verification approach, in one line:offer-stage gap disclosure and POA&M; SSP and associated POA&Ms available to the government on request; and agency validation under applicable agency procedures. The proposal does not establish one universal third-party certification mechanism — a real difference from CMMC.

Would the FAR CUI rule require NIST SP 800-171 Revision 3?

This is the single most important technical distinction on this page, and the one most likely to trip up a contractor who already knows CMMC. NIST published Revision 3 on May 14, 2024, superseding Revision 2 — but a NIST publication does not, by itself, rewrite every federal contract. For a full breakdown of the NIST 800-171 requirements and how they map to CMMC, see our requirements checklist.

Revision 3 (proposed FAR) vs. Revision 2 (current CMMC Level 2)

Source: 32 CFR Part 170 (CMMC Program Rule, effective Dec. 16, 2024); 91 FR 37550; NIST SP 800-171 Rev. 3 (May 14, 2024).

What the ODP reference means

Revision 3 introduced Organization-Defined Parameters— specific values for certain controls (password lengths, session-timeout windows, review frequencies) that an organization sets rather than treating one number as universal. The proposed FAR rule addresses this by pointing contractors to a government-provided set of ODP values for the applicable requirements — so where the clause specifies government values, you wouldn’t freely pick your own.

The prudent preparation path

If you already run to Revision 2 for DoD work, the reversible move is a crosswalk, not a rebuild:

1. Download NIST’s official Rev. 2 → Rev. 3 change analysis from NIST’s Computer Security Resource Center (CSRC).
2. Map your current controls, policies, evidence, and architecture first — then requirements.
3. Separate genuinely new requirements from reorganized ones.
4. Record ODP dependencies and cost/architecture implications.
5. Don’t change any contractual representation or baseline without authority.
6. Treat high-cost architectural changes as contingent until the rule and your contract are final.

Which NIST SP 800-172 edition would apply?

The proposal lets agencies select enhanced requirements from “NIST SP 800-172” for a critical program or high-value asset — but the edition question is worth pinning down. NIST published SP 800-172 Revision 3 in May 2026 and withdrew the original February 2, 2021 edition on May 13, 2026(NIST CSRC). Meanwhile, the current CMMC rule (32 CFR Part 170) still cites the February 2021 edition for Level 3. That’s a live version question a bidder should resolve in writing, not assume.

What we won’t tell you: that the clause “definitely” means Revision 3, or “definitely” means the 2021 edition, or that every contractor must implement all of 800-172. The proposal limits these enhanced requirements to a critical program or high-value asset, selected by the agency — not to ordinary CUI contracts.

How would the 72-hour incident-reporting rule work?

For CUI in a nonfederal environment, proposed FAR 52.240-7 would generally require a report within 72 hours of discovery — to DIBNet for DoD contracts and to CISA for non-DoD contracts — plus notice to the contracting officer, and to the next higher-tier contractor where applicable. It allows a tiered approach: report the facts you have, then supplement. A marking problem, by itself, is not a reportable incident unless it results in unauthorized disclosure, modification, destruction, or system access.

The reporting triggers — read the modalities

What counts as a CUI incident

Use the proposal’s four branches, and nothing broader:

• Unauthorized disclosure of CUI,
• Improper modification of CUI,
• Improper destruction of CUI, or
• Unauthorized access to the information system on which CUI resides.

Improper handling or a marking discrepancy doesn’t automatically become a “CUI incident” unless it produces one of those outcomes. Keep the separate unmarked-CUI notice duty (in 52.240-7(c)) in its own lane.

Where a report would go

Under the proposal’s nonfederal route: DoD contracts report to DIBNet; non-DoD contracts report to CISA’s incident-reporting portal. The contractor also notifies the contracting officer that a report was submitted, and notifies the next higher-tier contractor where applicable. For a CUI incident involving a FedRAMP-authorizedcloud service provider that has already reported through FedRAMP Incident Communication Procedures, the contractor isn’t required to file an additional report beyond following those procedures — but you still need to know who reported, what information reached you, and what notices remain owed to your CO or higher tier.

Initial report vs. supplemental report

The proposal doesn’t demand a complete forensic picture in the first 72 hours. You report the required data elements you have, notify the CO and any higher tier, then submit supplemental information as the investigation develops.

How long would incident evidence have to be preserved?

The contractor would preserve and protect available images of all known affected systems and relevant monitoring and packet-capture data until the government declines interest, or until 90 daysafter the report passes without a government request — whichever comes first. Build that retention step into your incident plan now; it’s easy to overlook and hard to reconstruct after the fact.

What happens if CUI is identified after award?

If the agency determines that newly encountered information is CUI and wants the contractor to handle it, the proposed procedures call for the SF XXX to be updated, the contract to be modified, and the contracting officer to consider an appropriate contractor request for equitable adjustment.In plain terms: if the government moves the goalposts mid-performance, there’s a proposed mechanism to reflect that in the contract — but nothing here promises that an adjustment will be granted or fixes an amount.

This is why your internal escalation path matters. When someone on your team believes they’ve received or created information that looks like CUI but isn’t on the SF, the proposal would have you safeguard it and notify the contracting officer — not ignore it and not unilaterally treat everything as CUI. Get that routing — employee to contracts/legal/security — working now, because it’s the same muscle you’ll use whether the final rule looks like this draft or not.

What would the rule require for cloud services, VDI, and telecom?

A cloud service that stores, processes, or transmits CUI identified on the SF XXX would have to meet security requirements equivalent to the FedRAMP Moderate baseline. The proposal also carves out narrow out-of-scope treatment for properly restricted keyboard/video/mouse-only VDI (virtual desktop infrastructure) endpoints and for certain shared commercial communications networks — but neither is a blanket exemption for remote devices, SaaS products, email, or “all telecom.” We pulled the exclusions straight from the clause text at FAR 52.240-7(d)(3)(ii)(A).

Federal vs. nonfederal systems are treated differently

Read the branches, because they’re easy to merge. For a federal information system, proposed FAR 52.240-7(d)(3)(i) would apply agency-identified requirements, with cloud security at no less than the FedRAMP Moderate baseline. For a nonfederal (contractor) system, paragraph (d)(3)(ii)(E) would require a cloud provider handling identified CUI to meet security requirements equivalent to FedRAMP Moderate, along with any selected paragraph (D) NIST SP 800-172 requirements. The VDI and commercial-communications exclusions live in paragraph (d)(3)(ii)(A).

Evidence to inventory for every provider that can touch CUI

The VDI exception — with its limits

Proposed FAR 52.240-7(d)(3)(ii)(A) treats an endpoint hosting a VDI client as an out-of-scope assetwhen it’s configured to prevent any processing, storage, or transmission of CUI beyond the keyboard/video/mouse traffic sent to the VDI client. The paths worth checking before you rely on the exclusion include local file transfer, clipboard use, printing, and caching. Scope conclusions require architecture evidence, not the word “VDI” on a diagram.

The commercial-communications exception — narrow

The same paragraph treats as out of scope commercial communications networks that carry government and non-government information using the same equipment, protocols, and methods, without regard to source or recipient — the common-carrier concept. Don’t stretch that into “anything sent over a network is out of scope.” It isn’t.

How would the FAR CUI rule flow down to subcontractors?

Proposed FAR 52.240-7 would flow down at every tier when a subcontract requires access — or the ability to access — CUI identified on the SF XXX.The flow-down would include the substance of the clause and the applicable SF information, reach commercial products and services other than sole-COTS, and require the subcontractor to report incidents through the government channel and notify the next higher tier where applicable. It’s access-based, not “every subcontractor gets the clause.”

The lazy version — “flow it to everyone” — creates cost and risk you don’t need. The decision sequence is narrower:

1. Will the subcontractor access, or have the ability to access, identified CUI?
2. Which CUI and handling activities are actually necessary?
3. Which contract-specific requirements apply?
4. Which clause information must flow?
5. Which systems and providers support the subcontract?
6. Where would incidents be reported?
7. Can you reduce the scope or the access instead?

Which DoD clause numbers should you look for in 2026?

If you do DoD work, the clause numbers on your 2026 solicitations may not match your old compliance mappings — and that’s not the FAR CUI proposal, it’s a separate Defense class deviation that’s already in effect.On February 1, 2026, DoD Class Deviation 2026-O0025 (“Revolutionary FAR Overhaul Part 40, DFARS Part 240”) renumbered several cyber clauses without new rulemaking. The underlying obligations largely didn’t change — the citations did.

Source: DoD Class Deviation 2026-O0025 (effective Feb. 1, 2026); DFARS 252.240-7997 and FAR 52.240-93 deviation text (Defense Acquisition Regulations System). For a full explanation of DFARS 252.204-7012 requirements, see our dedicated explainer.

Is the FAR CUI rule replacing CMMC or DFARS 252.204-7012?

No. The proposed FAR framework is governmentwide, while CMMC and DFARS 252.204-7012 are DoD-specific mechanisms with their own scopes and current contract effects.Proposed FAR 52.240-7 points to Revision 3; current CMMC Level 2 still points to Revision 2; and the July 13, 2026 suspension of CMMC Phase 2 did not remove existing DFARS 252.204-7012 obligations. These are parallel regimes, not one replacing another.

What would the FAR CUI rule’s paperwork burden be?

The Paperwork Reduction Act (PRA) notice tied to this rulemaking (91 FR 38438, published June 25, 2026; comments due August 24, 2026) revises two federal information collections and reports the consolidated “FAR Part 40 Requirements” collection at 19,894 respondents, 73,519 annual responses, and 213,987 annual burden hours. Read the fine print: these are paperworkhours for government information collections — not a cybersecurity implementation budget, not a CUI-only figure, and not what any single company will spend.

Source: 91 FR 38438 (June 25, 2026), OMB Control Nos. 9000-0189 and 9000-0199. These are information-collection paperwork figures, not cybersecurity implementation costs.

If you want a real implementation budget, it has to come from your own scoped gap analysis — not from a PRA line item. For a realistic sense of what CMMC-related compliance runs, see our CMMC Level 2 cost guide. Older vendor pages that cite the January 2025 draft’s Revision 2 cost assumptions as if they were the 2026 proposal’s costs aren’t a reliable current answer.

How do I comment on FAR Case 2026-001?

You can comment on the proposed rule through the federal docket until July 23, 2026 — cite “FAR Case 2026-001” (Federal Register document 2026-12559, 91 FR 37550, RIN 9000-AO86).This is the formal notice-and-comment step, which makes it the clearest chance to shape the clause language before it lands in solicitations. The separate Paperwork Reduction Act information-collection comment period runs until August 24, 2026.

What should contractors do before the FAR CUI rule is final?

Keep meeting the clauses in your current contracts, and prepare for the proposal through reversible work: inventory your clauses and CUI, map your systems and providers, crosswalk Revision 2 to Revision 3, test your incident escalation, review subcontract access, and write down the questions you need a contracting officer to answer.Don’t represent the proposed clauses as binding, don’t promise a final effective date, and don’t buy an expensive environment solely because a draft exists.

Act now vs. wait

A 30-day reversible-prep sequence

• Days 1–5Contract inventory. Agency; prime/sub status; the current FAR/DFARS/agency clauses (note legacy vs. 2026 deviation numbers); expected CUI; current incident route; current technical baseline; SPRS/CMMC status. Record contract numbers in your secure internal system, not in any web tool.
• Days 6–10CUI and system map. CUI categories and source; systems, facilities, users, cloud services, external providers, data flows, lower tiers.
• Days 11–15Version delta. Rev. 2 requirement/evidence vs. Rev. 3; new, reorganized, inherited, or not applicable; ODP dependency; effort estimate; which decisions can wait.
• Days 16–20Incident + marking workflow. Discovery timestamp; legal/contracts escalation; DIBNet vs. CISA decision; CO and higher-tier notice; supplemental report; the 90-day image/log preservation step; the unmarked-CUI route; the conflict-of-law route.
• Days 21–25Supplier + cloud register. Access vs. ability to access; flow-down basis; CSP evidence; incident cooperation; fourth parties; data location; termination/data-return controls.
• Days 26–30Executive decision. Current obligations; proposed exposure; high-confidence prep; deferred decisions; questions for CO/counsel; a comment position if you have one; budget scenarios, not one false number.

The questions to send your contracting officer

1. Is CUI expected to be involved in this acquisition?
2. Which CUI categories and source authorities apply?
3. Who is responsible for creating and marking the information?
4. Where will the CUI reside or transit?
5. Which edition of each NIST publication applies?
6. Which ODP values apply?
7. Are any NIST SP 800-172 requirements selected — and which edition?
8. Which incident-reporting instructions take precedence?
9. Which subcontractors need applicable SF information?
10. How will disclosed gaps and POA&Ms be evaluated?
11. Are there agency-specific requirements beyond the standard clause?
12. What happens if CUI is identified after award?

What we verified — and what’s still unsettled

We checked the June 23 proposal against the January 2025 proposal, the current FAR and DFARS, the February 2026 DoD class deviation, current 32 CFR Part 170, NIST’s publication-status pages, the July 13 CMMC suspension, and the associated PRA notice.Several things remain genuinely unsettled — the final effective date, the permanent SF number, the final clause language, and the exact NIST SP 800-172 edition the clause intends. We’d rather tell you that than paper over it with a guess.

What we actually verified (July 16, 2026)

• ✓Proposal type, docket (FAR-2026-0001), publication date, and comment deadline, at 91 FR 37550.
• ✓Proposed FAR 52.240-6 and FAR 52.240-7 text, including the VDI/telecom out-of-scope language at 52.240-7(d)(3)(ii)(A) and the reporting locations (DIBNet for DoD, CISA for non-DoD).
• ✓SF XXX's role and the proposed applicability trigger, including the sole-COTS exclusion.
• ✓The NIST SP 800-171 Revision 3 baseline and ODP language.
• ✓The NIST SP 800-172 reference — that the February 2021 edition was withdrawn May 13, 2026 and superseded by Revision 3, while current 32 CFR Part 170 still cites the February 2021 edition for CMMC Level 3.
• ✓The 72-hour reporting route, tiered reporting, the 90-day preservation window, and the FedRAMP-authorized-CSP exception.
• ✓The POA&M-at-offer, cloud, and flow-down provisions.
• ✓That current CMMC Level 2 remains Revision 2 (110 requirements, 14 families) under 32 CFR Part 170.
• ✓DoD Class Deviation 2026-O0025 (effective February 1, 2026) and the FAR 52.240-93 / DFARS 252.240-7997 renumbering.
• ✓The July 13, 2026 CMMC Phase 2 suspension — and that DFARS 252.204-7012 and Phase 1 self-assessment remain in force.
• ✓The PRA figures (19,894 / 73,519 / 213,987) and the August 24, 2026 PRA comment deadline, at 91 FR 38438.

How we produced this

We read the primary sources first — the Federal Register text, the current FAR and DFARS on Acquisition.gov, the DoD class-deviation memo, 32 CFR Part 170 on eCFR, and NIST’s CSRC pages. We used law-firm and industry analysis to spot common interpretations and errors, not as authority for the requirements themselves. Every “must,” “would,” and “should” on this page was checked against the operative source and its status, and each editorial conclusion is labeled as ours.

What’s still unsettled

FAR CUI rule 2026: frequently asked questions

These answers cover the follow-ups most likely to send a contractor back to search — status, timing, applicability, Revision 3, reporting, cloud, subcontractors, and CMMC. Each is short by design; the deeper explanation lives in the sections above.

Is the FAR CUI rule final?

No. FAR Case 2026-001 is a proposed rule published June 23, 2026 (91 FR 37550). It is not binding merely because it was published.

Is July 23, 2026 the effective date?

No. July 23 is the deadline to comment on the proposed rule. No final effective date has been announced.

What is FAR Case 2026-001?

It's the broader Revolutionary FAR Overhaul proposal covering several FAR parts, including the revised governmentwide CUI framework in FAR Parts 40 and 52.

What happened to FAR Case 2017-016?

That was the January 2025 CUI proposal (90 FR 4278). The June 2026 proposal materially revises it after the earlier version drew significant public comment.

Would the FAR CUI rule apply to civilian-agency contractors?

Yes, if finalized as proposed and the contract is expected to involve CUI. A governmentwide framework is the whole point.

Would it apply to every federal contractor?

No. The proposed clauses and SF XXX attach to acquisitions that involve CUI.

Is there a COTS exception?

Yes — the proposed prescription excludes acquisitions solely for commercially available off-the-shelf (COTS) items.

Could commercial products and services still be covered?

Yes. The exception is only for sole-COTS buys; other commercial products and services can be covered when CUI is involved.

What is SF XXX?

It's the placeholder name for the proposed standard form agencies would use to identify the CUI and the contract-specific safeguarding, marking, system, ODP, enhanced-control, and reporting requirements.

Would the rule use NIST SP 800-171 Revision 3?

Yes, for covered nonfederal systems under the proposal — but the proposal itself doesn't change your current contract.

Does Revision 3 currently replace Revision 2 for CMMC Level 2?

No. Current 32 CFR Part 170 still makes CMMC Level 2 identical to NIST SP 800-171 Revision 2 — 110 requirements across 14 families.

Which NIST SP 800-172 edition would apply?

The 2021 edition was withdrawn May 13, 2026 and superseded by Revision 3, while CMMC still cites the 2021 edition — treat the applicable edition as something to confirm with your contracting officer.

Is incident reporting 8 hours or 72 hours?

The June 2026 proposal uses 72 hours. The 8-hour figure belongs to the January 2025 draft. Check your current contract clauses independently.

Where would incidents be reported?

Under the proposed nonfederal route, DIBNet for DoD contracts and CISA for non-DoD contracts, plus notice to the contracting officer, with a FedRAMP-authorized-cloud exception in the clause.

How long would I have to preserve incident evidence?

The proposal would have you preserve affected-system images and relevant monitoring/packet-capture data until the government declines interest or 90 days pass after the report without a government request, whichever comes first.

Does deleting former FAR 52.240-YY eliminate unmarked-CUI reporting?

No. Proposed FAR 52.240-7(c) keeps a contractor duty to flag apparent unmarked or mismarked CUI to the contracting officer. The duty moved; it didn't disappear.

Would a POA&M have to be submitted with an offer?

Under proposed FAR 52.240-6(d), yes — when the offeror isn't compliant with an applicable requirement. A POA&M is not the same as compliance.

Would cloud providers need FedRAMP Moderate authorization?

The proposal says cloud providers handling identified CUI on a nonfederal system must meet security requirements equivalent to the FedRAMP Moderate baseline. Verify the evidence for your specific service.

Are VDI endpoints automatically out of scope?

No. The exception is limited to endpoints configured so CUI doesn't process, store, or transmit beyond the keyboard/video/mouse traffic to the VDI client.

Would the rule flow down to every subcontractor?

No. Proposed flow-down is tied to access — or the ability to access — CUI identified on the SF XXX.

Why does my 2026 DoD solicitation cite DFARS 252.240-7997 instead of 252.204-7020?

Because of DoD Class Deviation 2026-O0025 (effective February 1, 2026), which renumbered several cyber clauses. FAR 52.204-21 became FAR 52.240-93 and DFARS 252.204-7020 became DFARS 252.240-7997; DFARS 252.204-7019 was eliminated. Older contracts may still carry the legacy numbers.

Does the FAR proposal replace CMMC?

No. They're separate frameworks with different reach, baselines, and contract mechanisms.

Is CMMC Phase 2 still beginning November 10, 2026?

No. The Department of War suspended Phase 2 on July 13, 2026, including that scheduled transition.

Did the CMMC suspension remove DFARS 252.204-7012?

No. That clause remains a current obligation where it's in your contract, and Phase 1 self-assessment remains.

Should contractors implement the full proposal now?

Not automatically. Meet your current obligations and do reversible preparation while you wait for final text and contract direction.

Where should I get a definitive answer for my contract?

Confirm contractual applicability with your contracting officer and, where needed, qualified federal-contracts counsel; use a current Registered Practitioner or Registered Provider Organization for readiness, scoping, and implementation support.

Need help deciding what type of CMMC provider you need?

If your work actually involves CMMC or DFARS obligations and you’re trying to figure out the right kindof help, we can point you in the right direction. Tell us your level, scope, and timeline, and we’ll match you with source-checked CMMC provider options.

Primary sources

• •Proposed rule — FAR Case 2026-001, Revolutionary Federal Acquisition Regulation Overhaul, Parts 1, 2, 4, 33, 39, 40, and 53, 91 FR 37550 (June 23, 2026), FR Doc. 2026-12559; Docket FAR-2026-0001; RIN 9000-AO86.
• •Prior proposal — FAR Case 2017-016, Controlled Unclassified Information, 90 FR 4278 (Jan. 15, 2025), FR Doc. 2024-30437.
• •Paperwork Reduction Act notice — FAR Case 2026-001, 91 FR 38438 (June 25, 2026), FR Doc. 2026-12806 (OMB Control Nos. 9000-0189 and 9000-0199).
• •Executive Order 13556, Controlled Unclassified Information (2010); NARA implementing rule, 32 CFR Part 2002, 81 FR 63324 (Sept. 14, 2016).
• •Executive Order 14275, Restoring Common Sense to Federal Procurement (2025).
• •DoD Class Deviation 2026-O0025, Revolutionary FAR Overhaul Part 40, DFARS Part 240 (effective Feb. 1, 2026); DFARS 252.240-7997 and FAR 52.240-93 deviation text (Defense Acquisition Regulations System).
• •NIST SP 800-171 Rev. 3 (May 14, 2024), superseding Rev. 2 (Feb. 2020, updated Jan. 2021).
• •NIST SP 800-172 Rev. 3 (May 2026), superseding the Feb. 2, 2021 edition (withdrawn May 13, 2026).
• •DFARS 252.204-7012 (Safeguarding Covered Defense Information and Cyber Incident Reporting); DFARS 252.204-7021 (CMMC Requirements) (Acquisition.gov).
• •CMMC Program Rule — 32 CFR Part 170, 89 FR 83092 (published Oct. 15, 2024; effective Dec. 16, 2024); phase schedule at 32 CFR 170.3(e).
• •Department of War, suspension of CMMC Phase II (July 13, 2026), and implementing guidance.
• •CUI incident reporting portals: DoD — DIBNet (dibnet.dod.mil); non-DoD — CISA (cisa.gov/reporting-cyber-incident).