Governmentwide CUI Rule: What FAR Case 2026-001 Means Now

2026 FAR proposal status and a contractor’s action guide — from The Defense Compliance Report

By The Defense Compliance Report Editorial Team · Last reviewed July 2026 · Federal Register status verified July 16, 2026

If you searched governmentwide CUI rule, you probably want to know one thing first: are we already late?

Here’s the bottom line, up front. The governmentwide CUI rule — FAR Case 2026-001, published June 23, 2026 at 91 FR 37550 — is a proposed rule, not a final one. The public comment window closes July 23, 2026. If it’s finalized substantially as written, it would create a single, uniform way for federal contracts — defense and civilian alike— to spell out CUI requirements: new clauses (FAR 52.240-6 and FAR 52.240-7), a new agency-completed form (Standard Form XXX), NIST SP 800-171 Revision 3 for the parts of your systems that handle CUI, and 72-hour CUI incident reporting.

Now the distinction almost every headline blurs — and getting it wrong costs you either money or time. Two different things get called “the CUI rule,” and only one of them is new.

We read the 85-page proposed rule (91 FR 37550), cross-checked the clause text against multiple analyses, and confirmed the rule’s status directly against the Federal Register on July 16, 2026. This page is our attempt to end your search: what’s binding today, what’s only proposed, whether it reaches you, which NIST version applies, how it overlaps with DFARS and CMMC, and the moves worth making now — without treating a draft like a contract clause.

Is the governmentwide CUI rule actually in effect right now?

This is the single most important distinction on the page, so let’s be precise.

The CUI Program is real and old.Controlled Unclassified Information is unclassified information the government creates or possesses — or that a contractor creates or possesses for or on behalf of the government — that a law, regulation, or governmentwide policy requires or permits an agency to protect with safeguarding or dissemination controls. Plainer version: sensitive-but-unclassified government information you’re required to guard. Executive Order 13556 created the CUI Program in 2010, NARA issued the implementing rule at 32 CFR Part 2002 (effective 2016), and the CUI Registry catalogs 100-plus categories. Current law, agency policy, and contract terms can already require civilian and defense contractors alike to safeguard CUI. For background on what counts as CUI vs. general federal contract information, see our FCI vs. CUI guide.

The 2026 FAR clauses are new and proposed.What has been missing is a uniform FAR-level mechanism for identifying and communicating those requirements across agencies — the reason “governmentwide” is in the name. FAR Case 2026-001 is the FAR Council’s attempt to standardize that, and it’s part of the larger “Revolutionary FAR Overhaul,” the rewrite of the Federal Acquisition Regulation launched by Executive Order 14275 in April 2025.

So both statements below are wrong, and both are common:

• “The CUI rule doesn’t exist yet.”Incorrect — the CUI Program has governed federal information for over a decade.
• “The new governmentwide CUI rule is already in effect.”Also incorrect — the June 2026 FAR clauses are proposed.

Governmentwide CUI rule: the status timeline

Primary sources: Federal Register (91 FR 37550, doc 2026-12559); Executive Order 13556; NARA (32 CFR Part 2002).

The one honest catch — and why it should speed you up, not slow you down

Here’s the admission we owe you: this is a proposal.The clause numbers, the exact controls, even the timeline can still change before it’s final. Treat every specific below as “current as of the proposed rule,” not settled law. If you re-architect your whole environment tomorrow against a draft, you can waste real money.

Now the flip side, because “wait and see” is the more expensive mistake here:

• ▸Many of you already have current duties. Because the CUI Program already exists, existing law, agency policy, or contract clauses may already require you to protect CUI — regardless of what happens with this proposal. Waiting on the FAR rule doesn't pause obligations you already carry.
• ▸The direction is clear. The proposal adopts NIST SP 800-171 Revision 3 and even anticipates that the Department of Defense will move its own contractors to Revision 3 through a separate rulemaking. “Anticipates” isn’t “has done” — but it tells you where this is heading.
• ▸There’s no multi-year phase-in. Unlike CMMC, the proposal doesn’t lay out a phased, multi-year rollout. No effective date has been announced — but when a FAR rule is finalized, its clauses begin flowing into new solicitations, so the practical planning window is now, not “someday.”
• ▸The comment window is a real, closing opportunity. Until July 23, 2026, you can formally push back on anything that would burden you unfairly. After that, you're reacting to whatever survives.

The rational move isn’t to panic or to ignore it. It’s to pin down whether your contracts involve CUI, separate what already binds you from what’s merely proposed, and start the gap analysis you’ll need either way.

What CUI requirements bind contractors today, while FAR Case 2026-001 is still proposed?

Here’s the hierarchy to check, top to bottom:

1. Existing law, regulation, or governmentwide policy. The CUI Program is already in force. If a statute or governmentwide policy makes information CUI, protection obligations can already attach.
2. Your agency’s current CUI policy. Civilian agencies implement the CUI Program at different speeds and in different ways. Your requiring activity’s policy may already impose handling rules.
3. The clauses already in your contract. For DoD work, that commonly includes DFARS 252.204-7012 (safeguarding covered defense information and rapid incident reporting) and, where applicable, CMMC. For civilian work, it may be an agency-specific clause. These are what bind you today.
4. Flowdowns already in your subcontracts. If a prime has already flowed a CUI or covered-information clause to you, that clause governs now.
5. The proposed FAR clauses — not yet. FAR 52.240-6, FAR 52.240-7, and SF XXX are proposed. They would communicate new contract-specific CUI requirements only after finalization and incorporation.

The practical point: if someone tells you “the CUI rule now requires X,” your first question is which document is creating that obligation?A vendor alert isn’t a clause. A current contract clause is. The proposed FAR rule is a preview of what’s coming, not a live requirement.

Does the governmentwide CUI rule apply to DoD contracts, civilian contracts, or both?

You are likely in scope if:

• You hold or bid federal contracts — civilian or defense — that involve CUI.
• You’re a subcontractor who will receive CUI under a covered prime.
• You provide commercial products or services that nonetheless involve CUI handling or access.

You are likely not in scope (yet) if:

• Your contracts involve no CUI — only public or otherwise non-covered information.
• You sell only COTS items, with no associated CUI-handling services.

One point worth clearing up: DoD-only contractors are not categorically excluded from this rule. Because the FAR is the governmentwide foundation and DFARS is the DoD supplement on top of it, a finalized FAR CUI clause could apply to a DoD contract involving CUI alongside existing DFARS clauses and CMMC. How those overlapping obligations reconcile is exactly the kind of detail the final rule and DoD would have to sort out.

Which contractor are you? The applicability matrix

Editorial guidance grounded in the proposed clause text at 91 FR 37550 — not a legal determination.

What would the governmentwide CUI rule actually require?

Primary source: FAR Case 2026-001, 91 FR 37550. A POA&Mis a Plan of Action and Milestones — a documented plan to close security gaps by set dates. Federal systems and contractor-operated federal systems follow the separate, agency-identified federal-system requirements in the proposed clause.

NIST SP 800-171 Rev. 3 vs. Rev. 2: which one applies to you?

This is the trap. It catches good compliance teams because both statements are true at once and seem to contradict each other:

• Proposed FAR 52.240-7, for covered nonfederal systems, → Revision 3.
• CMMC Level 2 → Revision 2(written into 32 CFR Part 170, and held there for covered DoD contracts by DoD’s class deviation — Class Deviation 2024-O0013, Revision 1).

NIST published Revision 3 in May 2024. But publishing a standard doesn’t amend anyone’s contract. Revision 3 only binds you when a contract or program makes it apply — which, under an applicable contract, is what proposed FAR 52.240-7 would do if finalized and incorporated. See our full NIST SP 800-171 requirements checklist for the Revision 2 control families and evidence your contract likely requires today.

Rev. 2 vs. Rev. 3, side by side

Primary sources: NIST SP 800-171 Rev. 2 and Rev. 3 (NIST CSRC); 32 CFR Part 170; DoD Class Deviation 2024-O0013, Rev. 1.

What an ODP is, in plain terms:some Revision 3 requirements leave a value to be set — a frequency, a duration, a threshold — that the organization (often the agency) defines. The proposal points contractors to a published ODP set for the applicable requirements, and agencies can specify their own for any SP 800-172 controls they add. Practical upshot: the ODP source is an external, changeable artifact, so re-check it rather than assume it’s frozen.

If you’re a Revision 2 shop today, don’t panic-rebuild.The two revisions overlap heavily, so genuine Rev. 2 work is not wasted. The smart, no-regret move is a crosswalk: map your systems first, then map Rev. 2 controls to their Rev. 3 equivalents, flag the genuinely new requirements (the new families, the ODPs), and prioritize the gaps that also strengthen your security. Just don’t represent that crosswalk as a completed Rev. 3 assessment — it isn’t one.

How does the governmentwide CUI rule overlap with DFARS 252.204-7012 and CMMC?

Think of it as layers, not lanes — DFARS sits on top of the FAR for DoD buys, so a DoD contract can carry both.

How the current and proposed authorities overlap

Primary sources: DFARS 252.204-7012 and -7019/-7020/-7021; 32 CFR Part 170; 91 FR 37550; U.S. Department of War release (July 13, 2026). FCIis Federal Contract Information — information not for public release, generated for or provided by the government under a contract. DIBNet is DoD’s incident-reporting portal; CISA is the Cybersecurity and Infrastructure Security Agency.

Why Revision 3 does not automatically move CMMC to Revision 3: NIST publishing Rev. 3 didn’t touch 32 CFR Part 170, and neither does this FAR proposal. CMMC Level 2 still incorporates Revision 2 (110 controls, 14 families, per 32 CFR § 170.14). The proposal says harmonization is intendedto happen through separate DoD rulemaking — but it doesn’t set when, whether, or exactly how. So keep separate authority maps, and don’t rebuild your CMMC program around Revision 3 on the strength of this proposal.

What changed for CMMC on July 13, 2026 — and what didn’t

On July 13, 2026, the Department suspended the transition to CMMC Phase II— the phase that would have started requiring third-party (C3PAO) assessments in DoD contracts on November 10, 2026 — and held pending and future implementation milestones in abeyance while it conducts a review.

Here’s the part people miss: the pause did not erase anything you already owe. During the suspension, contracting officers may still require CMMC Level 1 (Self) or Level 2 (Self) self-assessments. DFARS 252.204-7012 is unchanged. NIST SP 800-171 Revision 2 remains the enforced defense standard. Your SPRS obligations continue — that includes maintaining a current NIST SP 800-171 DoD Assessment score under DFARS 252.204-7019/-7020, and, where CMMC applies, your CMMC self-assessment result and annual affirmation under DFARS 252.204-7021. Knowingly false cybersecurity representations can carry False Claims Act risk — ordinary noncompliance or an honest inaccuracy doesn’t automatically create liability, but the government’s Civil Cyber-Fraud Initiative targets knowing misrepresentations.

The takeaway for this page:the Department paused the transition to CMMC’s assessment phase while the FAR Council kept a separate governmentwide rulemaking moving. It’s a study in contrasts, not a contradiction — the FAR rule is neither DoD-only nor civilian-only, and none of this changes CMMC’s current Revision 2 baseline.

Disclosure: The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We may receive compensation for qualified introductions, sponsorships, or partner referrals when disclosed. Compensation does not control our regulatory analysis, provider-category recommendations, or Cyber AB status verification.

What is Standard Form XXX, and how would it identify your CUI?

We read the form’s proposed structure so you know what to expect on it:

• Part A — whether you’re expected to handle CUI under the contract. (“Handling” is defined broadly: accessing, processing, transmitting, safeguarding, re-using, or disposing of CUI.)
• Parts B and C — whether the CUI will reside in a federally controlled facility or a non-federally controlled (your) facility.
• Marking responsibilities — what you must mark and how.
• Part D — whether the enhanced requirements of NIST SP 800-172 apply.

If the SF XXX is missing, incomplete, or contradicts the clauses: don’t ignore it. Preserve and limit access to the information, document the exact inconsistency, notify the contracting officer, and get written clarification or a contract modification.

What would you have to report within 72 hours?

The three 72-hour clocks

Primary source: FAR 52.240-7, at 91 FR 37550.

What counts as a “CUI incident.”The proposal defines it as unauthorized disclosure, improper modification, or improper destruction of CUI — in any form — or unauthorized access to the information system where CUI resides. Two things the June 2026 version fixed from the 2025 draft: it dropped “suspected” incidents from the definition, and it expressly says improper handling (like unmarked or mismarked CUI) is notan incident unless it results in one of those outcomes. That’s a meaningful narrowing, and it’s why the marking-notice path is separate from the incident path.

The first report can be incomplete.You submit the data elements you have; if the investigation later turns up material gaps, you supplement. The FAR Council chose 72 hours specifically to align with DFARS 252.204-7012, to give you time to confirm whether an event even qualifies, and to make initial reports more accurate. Use that time — but build the internal triage path now so security, legal, contracts, and leadership can move fast when the clock starts.

After an incident, the proposal also expects you to inventory what CUI was or could have been accessed, reconstruct a timeline of user activity, determine how the access happened, cooperate with the agency, and preserve available images of the affected systems and relevant monitoring or packet-capture data until the government declines interest, or until 90 days pass after the report without a government request — whichever comes first. If your logging and imaging can’t support that today, that’s a gap worth closing regardless of this rule.

What would the rule require for the cloud and FedRAMP Moderate?

Worth knowing: the January 2025 draft required cloud providers to be FedRAMP Moderate authorized, with no room for an equivalency determination — a stricter posture than even DoD’s. The June 2026 version added the equivalency path. So on cloud, the current proposal is actually more flexible than its predecessor.

Map every relationship that could touch CUI— SaaS, IaaS, PaaS, managed security tooling, backup, SIEM/log collection, help desk, identity providers, file transfer, and email — and, for each, get the architecture, the authorization-or-equivalence evidence, the incident-responsibility matrix, and the subprocessor list. A platform marketed as “CUI-ready” can shrink your scope and your burden, but buying it does not decide your contract obligation, your system boundary, or your compliance status. That’s still on you.

One proposed scoping relief worth knowing:the rule would treat certain endpoints as out of scope — specifically, a virtual desktop infrastructure (VDI) endpoint configured so that nothing but keyboard, video, and mouse signals move to the client, with no processing, storage, or transmission of CUI on the device itself. If you rely on that, document the configuration that proves it. The word “VDI” alone won’t carry it.

What would flow down to your subcontractors?

If you’re the prime, the mechanics are specific: you include the substanceof FAR 52.240-7 in the subcontract without alteration (except party names) and share the relevant SF XXX information so the sub knows exactly which CUI applies. The sensible move is data minimization — flow only what the work actually requires, strip unnecessary CUI from the package, and don’t paper every purchase order with a full CUI flowdown it doesn’t need.

If you’re the sub who just got a prime’s questionnaire,slow down and ask the questions that separate a real obligation from a “get-ready” survey:

1. Which prime contract or solicitation drives this?
2. What CUI will I actually receive or create?
3. Where is it identified — is there an SF XXX?
4. Which systems are expected to touch it?
5. Which NIST revision and ODP set are being required?
6. Is this a current clause, prime policy, or future-readiness request?
7. Where must incidents be reported?
8. Can I structure the work to avoid receiving the data at all?

A prime can make CUI your problem quickly. Knowing which of those eight answers applies is the difference between an informed yes and an expensive one.

What changed between the January 2025 and June 2026 FAR CUI proposals?

Primary sources: 90 FR 4278 (Jan. 2025); 91 FR 37550 (June 2026).

A real example of why the comment window matters

The January 2025 draft demanded incident reports within eight hours. Commenters told the FAR Council that eight hours wasn’t enough time to investigate, triage, and accurately characterize an event. In the June 2026 rule, the Council changed it to 72 hours, and said so — citing those industry comments, alignment with DFARS 252.204-7012, and the goal of more accurate first reports. That’s documented evidence, in the rule’s own preamble, that this proposal is still movable — and that the comment period closing July 23 is a real lever, not a formality. (Some current summaries still describe the January 2025 draft; check the date before you trust a “CUI rule” explainer.)

What would complying with the governmentwide CUI rule cost?

Source: FAR Council regulatory-impact analysis in the January 2025 proposed rule (90 FR 4278), Revision 2 baseline, at a $95/hour labor rate; excludes system-security-plan maintenance time. The June 2026 version keys to Revision 3, so the current figures could differ. Confirm in 91 FR 37550 before budgeting. For comparison, see also our analysis of CMMC Level 2 certification costs (a separate, DoD-specific program).

Two honest notes on these numbers. First, they’re the reason “before you spend six figures” isn’t hyperbole — the government’s own estimate puts total first-year costs into six figures for both small and larger firms. Second, your actual number depends entirely on where you’re starting: a firm with mature DFARS 7012 practices has a real head start, while a contractor without an existing NIST SP 800-171 program may face a materially larger implementation gap. That’s precisely why the first dollar you spend should confirm scope, not buy tools.

What should you do now — without overreacting to a draft?

A prioritized starting sequence:

1. Inventory the paper. Pull your active solicitations, contracts, subcontracts, modifications, and any prime questionnaires. For each asserted “CUI” duty, write down the exact clause or authority behind it. Half the anxiety on this topic evaporates once you separate a vendor email from a contract clause.
2. Confirm CUI scope. Identify the CUI categories you actually handle and the open classification questions. Confirm with your contracting officer or counsel — CUI status comes from law and policy, and the agency identifies it, not a checklist.
3. Map the environment. Systems, cloud services, external providers, and subcontractors that touch the information. You can't scope controls before you scope data flows.
4. Fix the record. If any internal or public statement claims Revision 3 is already the CMMC Level 2 baseline, correct it. It isn't.
5. Crosswalk Rev. 2 → Rev. 3. Build the gap map. Prioritize the changes that also strengthen your security today.
6. Rehearse the 72 hours. Test whether a suspected-CUI or incident event reaches contracts, legal, and security fast enough — and whether you can preserve system images under the proposed retention condition.
7. Decide whether to comment. If the proposal would burden you unfairly, file a comment before July 23, 2026, referencing FAR Case 2026-001 at regulations.gov (docket FAR-2026-0001).

Who should answer which question?

One reason this rule feels overwhelming is that it mixes questions that belong to very different people. It helps to route each one to the right place.

Notice we did nottell you to call a C3PAO to fix your gaps. Readiness and formal assessment must stay separate: under the CMMC rules, a firm that served as your consultant preparing for a CMMC assessment in the prior three years generally can’t perform your Level 2 certification assessment (32 CFR Part 170), and C3PAOs must identify and mitigate conflicts of interest under the CMMC Assessment Process. Keep those lanes clean. See our CMMC provider categories guide for how to choose the right kind of help.

Disclosure: The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We may receive compensation for qualified introductions, sponsorships, or partner referrals when disclosed. Compensation does not control our regulatory analysis, provider-category recommendations, or Cyber AB status verification.

What could still change — and what the headlines get wrong

Still unsettled as of July 16, 2026: the final publication and effective dates, any grandfathering, the final form and clause wording, how the ODP set will be maintained, whether agencies will layer on deviations, how enforcement will work, and what the CMMC review concludes.

Eight things we keep seeing stated as fact that are not:

1. “The proposal is already effective.” It’s proposed.
2. “Every federal contractor will get the CUI clause.” Only when the agency identifies CUI in the work.
3. “Everyone must move to Revision 3 now.” Only where a current contract requires it.
4. “Revision 3 has replaced Revision 2 for CMMC.” It hasn’t — CMMC Level 2 is still Rev. 2.
5. “Every marking error is a reportable incident.” It isn’t, unless it causes disclosure, alteration, destruction, or unauthorized access.
6. “Every cloud provider must hold a FedRAMP authorization.” The baseline is equivalent to FedRAMP Moderate; “authorized” appears only in the narrow incident exception.
7. “COTS and commercial mean the same thing.” They don’t — commercial services can be covered; COTS-only is excluded.
8. “The July 13 CMMC pause wiped out my current duties.” It didn’t — DFARS 7012, Revision 2, SPRS obligations, and knowing-misrepresentation risk all remain.

How The Defense Compliance Report verified this analysis

We built this page from primary sources and dated the verification.Our editorial team read the June 23, 2026 proposed rule and its draft clause text, NARA’s CUI Program guidance, NIST’s Revision 3 publication, the current DFARS clauses, the CMMC Program Rule at 32 CFR Part 170, and the Department’s July 13, 2026 CMMC suspension release. We used law-firm and vendor summaries only to spot issues and cross-check ourselves — never as the authority for a requirement.

Why this page exists:contractors are being asked to reconcile an existing CUI Program, a revised proposed FAR rule, current DFARS clauses, two NIST revisions, prime-contractor questionnaires, and a freshly suspended CMMC schedule — all at once. This page exists to keep you from mistaking a proposal for a contract requirement, and from dismissing the current duties you already owe just because the new FAR rule isn’t final.

Governmentwide CUI rule FAQ

These answers cover the edge cases most likely to send you back to search. Each is written to stand on its own and points to the governing authority.

Is the governmentwide CUI rule final?

No. FAR Case 2026-001 is a proposed rule, published June 23, 2026 (91 FR 37550). The comment period closes July 23, 2026, and no final effective date has been announced.

When will the governmentwide CUI rule take effect?

No effective date has been set. It would take effect only after the FAR Council finalizes the rule and the clauses are inserted into contracts. Unlike CMMC, the proposal doesn’t lay out a phased, multi-year rollout.

Does it apply to DoD contracts, civilian contracts, or both?

Both. The rule is governmentwide; the proposed clause routes incident reports to DIBNet for DoD contracts and to CISA for non-DoD contracts, and it would apply whenever a covered acquisition involves CUI.

Does every federal contractor have to comply with FAR 52.240-7?

No. The clause would apply only when the buying agency determines CUI is involved and completes an SF XXX identifying it.

Are COTS-only contracts excluded?

Yes. Acquisitions solely for commercially available off-the-shelf items are excluded, though a COTS product bundled with services or CUI handling may not qualify as COTS-only.

Does NIST SP 800-171 Revision 3 apply to contractors today?

Only when a current contract or program makes it apply. The June 2026 proposal alone does not bind anyone.

Has CMMC Level 2 moved to Revision 3?

No. CMMC Level 2 still incorporates NIST SP 800-171 Revision 2 (110 requirements, 14 families) under 32 CFR Part 170.

Did the Department cancel CMMC?

No. On July 13, 2026, it suspended the transition to Phase II (third-party assessments) and pending and future milestones pending a review. CMMC Level 1 and Level 2 self-assessments, DFARS 252.204-7012, and SPRS obligations remain in force.

Is unmarked or mismarked CUI automatically a CUI incident?

No. Under the proposed definition, improper handling alone is not an incident unless it results in unauthorized disclosure, improper modification or destruction, or unauthorized access. It triggers a separate 72-hour notice to the contracting officer and an interim duty to safeguard the information.

Where would CUI incident reports go?

Under the proposal, to CISA for non-DoD contracts and to DoD’s DIBNet portal for DoD contracts, within 72 hours, with notice to the contracting officer (and the next higher-tier contractor when applicable).

Does a FedRAMP provider’s report eliminate my duties?

Not entirely. A FedRAMP-authorized cloud provider reporting through FedRAMP procedures wouldn’t require a duplicate report, but you still need to confirm what information reaches you and which notices you still owe.

Would POA&Ms be allowed?

The proposal requires offerors that can’t meet all requirements at proposal time to disclose the gaps and submit a Plan of Action and Milestones. A POA&M is not the same as being compliant, and don’t assume CMMC’s specific POA&M rules carry over to the FAR proposal.

Are VDI endpoints out of scope?

Only the narrowly described configuration is — a VDI endpoint set up so that nothing but keyboard, video, and mouse signals reach the client, with no CUI processed, stored, or transmitted on the device. Keep the configuration evidence.

How can I comment on the proposal?

Before July 23, 2026, submit comments at regulations.gov under docket FAR-2026-0001, referencing FAR Case 2026-001.

The next step, depending on where you are

If you’re still figuring out whether this even applies to you, use the path tool before you request implementation quotes — no CUI, no login.

If you’re a DoD contractor who needs to choose a compliance path, the Find My CMMC Path tool routes you to the right provider category before you spend.

Disclosure: The Defense Compliance Report is an independent trade publication on CMMC 2.0 and DIB compliance. We may receive compensation for qualified introductions, sponsorships, or partner referrals when disclosed. Compensation does not control our regulatory analysis, provider-category recommendations, or Cyber AB status verification. This matching step may generate referral or qualified-introduction compensation. It does not determine your legal obligation, CMMC status, assessment result, or certification outcome.

Primary sources referenced on this page

• Federal Register — FAR Case 2026-001, 91 FR 37550 (June 23, 2026) — the governing proposed rule
• Official rule PDF (govinfo)
• Comment docket (regulations.gov) — FAR-2026-0001
• Federal Register — January 2025 CUI proposed rule (superseded), FAR Case 2017-016, 90 FR 4278
• NARA — Controlled Unclassified Information Program (32 CFR Part 2002; CUI Registry)
• NIST SP 800-171 Rev. 3 (CSRC)
• NIST SP 800-171 Rev. 2 (CSRC)
• NIST SP 800-172 (CSRC)
• DFARS 252.204-7012 (Acquisition.gov)
• DFARS 252.204-7019 / -7020 / -7021 (Acquisition.gov)
• DoD Class Deviation 2024-O0013, Rev. 1 (NIST SP 800-171 Rev. 2)
• CMMC Program Rule, 32 CFR Part 170 (eCFR)
• U.S. Department of War — CMMC Phase II suspension release (July 13, 2026)