The FAR CUI Rule Would Bring NIST 800-171 Rev 3 to Every Agency. Here Is What to Know

If you handle controlled unclassified information for any federal agency, plan for NIST SP 800-171 Rev 3 and 72-hour incident reporting. The FAR Council re-proposed its CUI rule as FAR Case 2026-001 on June 23, 2026, superseding the 2025 proposal under FAR Case 2017-016 (Federal Register). Comments closed July 23, and a final rule is targeted before the end of 2026, reportedly without a phase-in (Hunton Andrews Kurth).

While attention has been on the CMMC rework, the FAR CUI rule has been moving on its own track. CMMC applies to Defense contracts. The FAR rule would apply government-wide, which means contractors to Energy, Homeland Security, NASA, HHS, and other civilian agencies would face NIST SP 800-171 obligations for the first time through a uniform clause.

What the proposal does

• Standard. Contractors handling CUI on their systems would implement NIST SP 800-171 Revision 3 (Hunton). That is a newer revision than the Rev 2 baseline DFARS 7012 currently uses.
• Incident reporting. Suspected or confirmed CUI incidents would be reported within 72 hours. The 2025 proposal had set eight hours, which drew heavy criticism.
• Clauses. New clauses at FAR 52.240-6 and 52.240-7 in a new FAR Part 40, with a standard form for agencies to identify CUI in the contract.
• Flow-down. Requirements flow to subcontractors at all tiers that handle CUI. Commercially available off-the-shelf items are excepted.

Details per the Federal Register notice and Hunton's analysis. The proposal drew 96 public comments.

What it means if you are already under DFARS 7012

Defense contractors already implementing NIST SP 800-171 Rev 2 are not starting over, but Rev 3 is not identical. It reorganizes the requirements, adds organization-defined parameters, and introduces requirements in areas like supply chain risk management. We mapped the differences in NIST 800-171 Rev 3 and CMMC Level 2. A contractor with both DoD and civilian work could find itself managing two revisions at once until DoD aligns.

Where the CMMC ecosystem stands

Readiness capacity matters, because if the FAR rule takes effect without a phase-in, demand for help will spike. At the Cyber AB's September 29 town hall, figures reported included 2,362 Level 2 certificates issued, 71 conditional, 151 assessments in progress, 117 authorized C3PAOs, and 1,179 certified assessors (The Defense Compliance Report; Cyber AB). That is a small base relative to the number of companies that touch CUI.

How to prepare

1. Find your CUI. Civilian contractors often have not formally identified it. Review contracts for CUI markings and data handling language.
2. Run a Rev 3 gap assessment, even if you are currently on Rev 2. Start with the new and changed requirements.
3. Build the 72-hour reporting path. Know who decides an incident is reportable, who files, and how evidence is preserved. A 24/7 SOC that can detect and scope incidents quickly is what makes 72 hours achievable.
4. Talk to your subcontractors. The all-tier flow-down means your suppliers' readiness becomes your problem. Our post on DFARS 7012 flow-down applies here too.
5. Consider an enclave. Narrowing the systems that touch CUI is usually cheaper than bringing the whole company into scope. See GCC High enclave vs. full migration.

Cyberuptive helps defense and civilian contractors scope CUI environments and monitor them. See our compliance services or start an assessment.

Frequently asked questions

What is the FAR CUI rule?

A proposed Federal Acquisition Regulation rule, FAR Case 2026-001, that would set uniform requirements for contractors handling controlled unclassified information across federal agencies, including NIST SP 800-171 Rev 3 and 72-hour incident reporting.

When was the FAR CUI rule re-proposed?

On June 23, 2026, in the Federal Register, superseding the earlier proposal under FAR Case 2017-016. Comments closed July 23, 2026.

Does the FAR CUI rule use NIST SP 800-171 Rev 2 or Rev 3?

The re-proposed rule would require NIST SP 800-171 Revision 3.

How fast would contractors have to report CUI incidents?

Within 72 hours under the re-proposed rule, replacing the eight-hour window in the earlier proposal.

Does the FAR CUI rule flow down to subcontractors?

Yes. It would flow down to subcontractors at all tiers that handle CUI, with an exception for commercially available off-the-shelf items.