Fourteen years after Executive Order (EO) 13556 established the Controlled Unclassified Information (CUI) program (the CUI Program), the FAR Counsel has at long last issued a proposed rule establishing a uniform FAR CUI rule. 90 Fed. Reg. 4278 (Jan. 15, 2025) (implementing EO 13556 (November 4, 2010)). The FAR CUI proposed rule establishes a government-wide contract clause requiring the implementation of cybersecurity standards in NIST SP 800-171 for the protection of CUI. Its creation is part of the Government’s larger strategy to identify, deter, protect against, detect, and respond to increasingly sophisticated criminals and cyberattacks targeting the Federal government and its contractors.  

Currently, agencies can employ ad hoc, agency-specific policies to manage CUI, an approach that can lead to agencies marking and handling information inconsistently and inefficiently, and causing confusion among contractors that may not realize information they are handling is nonpublic, confidential information that requires safeguarding. The new rule would create a common mechanism, the Standard Form XXX (SF XXX), Controlled Unclassified Information (CUI) Requirements, “to enable a uniform process for communicating the information contractors must manage and safeguard as well as identify where a CUI incident must be reported and when there are CUI incident reporting requirements that differ from or are in addition to those in the clause at FAR 52.204-XX(g).” 90 Fed. Reg. 4278, 4279. While this proposed rule would not change what is already protected under NIST SP 800-171, it will provide a standard (and arguably clearer) way that these requirements are identified and shared with contractors. The proposed FAR rule is largely modeled after DFARS § 252.204–7012, Safeguarding Covered Defense Information and Cyber Incident Reporting, though there are some noted differences like new definitions and an 8 hour reporting requirement for a CUI incident (FAR) versus a 72-hour reporting requirement for a cyber incident (DFARS).  The FAR Council states that the new FAR clause “does not conflict with the existing [DFARS] clause [and i]t is expected that the DFARS clause will be amended in the future to address DoD-specific requirements that may be in addition to the FAR clause.” 90 Fed. Reg. 4278. 

The CUI program was originally created to support intra-government sharing of information and was broadened to include protections for information shared with federal contractors. Current CUI protections are set forth in NIST 800-171 and NIST 800-172 (Enhanced Security Requirements for Protecting Controlled Unclassified Information). The FAR does not presently cover CUI and only has FAR § 52.204-21, which protects federal contract information (FCI) by requiring contractors to apply 15 “basic safeguarding requirements and procedures to protect covered contractor information systems.” FAR § 52.204-21(b)(1). FCI is any data “that is provided by or generated for the Government under a contract to develop or deliver a product or service to the Government.” FAR § 52.204-21(a). CUI is a generalized classification for information that covers a broad spectrum of data that, although not deemed classified, is subject to dissemination and security controls to protect its confidentiality. All CUI in possession of a Government contractor is FCI, but not all FCI is CUI. FAR § 52.204-21(b)(2) (“This clause does not relieve the Contractor of … or other Federal safeguarding requirements for controlled unclassified information (CUI) as established by Executive Order 13556.”).  

The proposed rule’s key changes: 

• Creates SF XXX, titled Controlled Unclassified Information (CUI) Requirements, that will be included in solicitations and contracts that may result in the handling of CUI and provides CUI requirements that will ultimately become performance requirements during contract performance.
• Provides uniform definitions for “contractor-attributional information,” “controlled unclassified information (CUI),” “CUI incident,” and “CUI Registry,” which will be added to FAR § 2.101 definitions. New definitions will be added in other FAR parts, as well.  
• Amends FAR § 3.104-4 (Disclosure, protection, and marking of contractor bid or proposal information and source selection information) to require offerors and contractors to make all reasonable efforts to mark “any contractor bid or proposal information, contractor-attributional information, proprietary business information, and source selection information submitted to the Government” with the marking: “Source Selection Information-See FAR 2.101 and 3.104.” 90 Fed. Reg. 4278, 4291.
• Adds a new solicitation provision FAR § 52.204–WW, Notice of Controlled Unclassified Information Requirements, informing offerors of requirements on restricted use of Government-provided information, on appropriately identifying sensitive offeror-provided information, and on notifying the Government of unmarked or mismarked CUI.
• Adds two new contract clauses:
  • FAR § 52.204–XX, Controlled Unclassified Information, requiring contractors to comply with applicable CUI requirements, if the SF XXX indicates that the contractor is expected to collect, develop, receive, transmit, use, handle, or store CUI under the contract. This clause will be applicable to commercial products and services contracts, simplified acquisitions for other than commercial products or services, and will flow down to subcontracts. If contractors intend to flow down CUI to a subcontract, they must prepare an SF XXX for the subcontractor.
  • FAR § 52.204-YY, Identifying and Reporting Information That Is Potentially Controlled Unclassified Information, will be included in contracts where the SF XXX indicates that no CUI is involved in the performance of the contract. This clause will flow down to subcontracts.
• Adds a requirement to train employees on handling CUI before allowing them to collect, develop, receive, transmit, use, handle, or store CUI. The training requirements and frequency will be identified in the SF XXX. Record of this training must be maintained because contracting officers are allowed to request evidence of training.
• Adds a process for how to handle unmarked or mismarked CUI, asking offerors and requiring contractors to notify the Contracting Officer Representative or other designated agency official concerning any unmarked or mismarked CUI, if discovered.
• Adds a requirement for contractors to report suspected or confirmed CUI incidents within 8 hours, unless a different time period is required for a specific category of CUI or a Federally-controlled facility.
• Allows the Government to ask for certain information, which contractors must provide, including but not limited to:
  • Supporting documentation to verify compliance with the system security plan required by NIST SP 800-171 Revision 2 and
  • When CUI incidents have occurred, information to verify the contractor and its subcontractors have provided training to their employees that handle CUI.

How this proposed rule may impact our clients:

If the proposed rule becomes final without any changes, the new SF XXX will provide clarity on what information is CUI and how to properly safeguard the CUI. These uniform requirements will improve contractors’ abilities to protect Federal information and information systems from criminals and US-adversaries. Additionally, all federal contracts will include either FAR § 52.204–XX (if CUI is expected) or FAR § 52.204-YY (if no CUI is expected), which should clarify for contractors what exactly are their CUI compliance obligations. One of the reasons this is important, beyond protecting Federal government information from criminals and US adversaries, is because claiming compliant CUI protections are in place when they are not may give rise to False Claims Act (FCA) liability. Successful FCA claims result in a penalty as well as triple damages. 31 U.S.C. § 3729(a)(1)(g) (penalty plus “plus 3 times the amount of damages which the Government sustains because of the act of that person”). 

Comments on the proposed rule must be submitted on or before March 17, 2025.