How Does the FAR CUI Rule Affect Federal Contractors?

The FAR CUI rule, initially published as a draft on January 14, 2025, and substantially revised in June 2026 under the Revolutionary FAR Overhaul (RFO), is a governmentwide contract clause requiring the implementation of NIST SP 800-171 Revision 3 to protect Controlled Unclassified Information (CUI). It outlines the specific requirements for how contractors and subcontractors are expected to handle CUI. The FAR CUI rule intends to improve the government’s ongoing efforts to identify, detect, respond to, and protect against malicious threat actors.

We’ve identified six key takeaways that every contractor needs to know to navigate the complexities of the FAR CUI rule.

The FAR CUI rule creates a standard form (SF) for identifying if CUI will be incorporated into the contract, what category of CUI it is, and the corresponding safeguarding requirements for the protection of said CUI.

“The SF XXX, Controlled Unclassified Information, which is incorporated into this contract identifies what controlled unclassified information (CUI) is involved in the contract. The Contractor is required to safeguard only the CUI that is identified in the SF XXX.”

There is a clear definition of what CUI is and is not. As defined in the rule, CUI is “information that the Government creates or possesses, or that an entity creates or possesses for or on behalf of the Government, that a law, regulation, or Governmentwide policy requires or permits an agency to handle using safeguarding or dissemination controls.”

Contractors must secure any information they believe is CUI, even if that information isn’t identified in the SF XXX or is not marked or properly marked as required in the SF XXX. The information must be safeguarded until the Contracting Officer can make a final determination on the proper marking of the information.

Contractors must now report any suspected or confirmed CUI incidents to their Contracting Officer within 72 hours. This aligns the FAR CUI rule with standard defense timelines (like DFARS 252.204-7012), removing the heavily criticized 8-hour reporting window proposed in the early 2025 draft.

If a Contractor uses cloud services to store, process, or transmit any CUI identified in SF XXX, then the cloud service provider must meet the FedRAMP Moderate baseline requirements. While the early draft eliminated FedRAMP equivalency, updated guidance continues to clarify how contractors can achieve acceptable compliance baselines or equivalents under modern federal cloud security standardizations.

The government’s official cost estimates for implementing NIST SP 800-171 Revision 3 have been highly scrutinized. Below is a breakdown of the anticipated compliance costs as adjusted for the more stringent Revision 3 baseline rules:

The estimates above don’t consider the cost of the specific software or hardware that may need to be implemented, the number of users, the complexity of the network, and more. For those, revised frameworks indicate that infrastructure costs will likely outpace the government's legacy estimates of $27,500 initially / $5,000 annually for small businesses, and $140,000 initially / $80,000 annually for larger organizations.

Federal Register. (2026, June 23). Federal Acquisition Regulation: Revolutionary Federal Acquisition Regulation Overhaul. FAR Case 2026-001. Available at Federal Register Online.