RFO Rulemaking Gives Contractors a Second Opportunity to Comment on FAR CUI Rule

Short summary

FAR Council reopened public comments on revised CUI handling rules for federal contractors, extending incident reporting from 8 to 72 hours, deleting a notification clause, and requiring NIST SP 800-171 rev. 3 compliance. Comments due July 23, 2026.

• •CUI incident reporting timeline extended to 72 hours, aligning with DFARS and critical infrastructure standards
• •NIST SP 800-171 rev. 3 now mandated for protecting CUI on non-federal systems
• •Public comment period open until July 23, 2026 for contractors to provide feedback before finalization

Generated with AI, which can make mistakes.