Federal Acquisition Regulation: Controlled Unclassified Information
Published Date: 1/15/2025
Proposed Rule
Summary
The Department of Defense, GSA, and NASA want to update rules to better protect Controlled Unclassified Information (CUI) in government contracts. This means contractors handling sensitive but not secret info will follow new security steps. Comments on these changes are open until March 17, 2025, so get ready to share your thoughts—this could affect how contracts are managed and might add some costs for compliance.
Analyzed Economic Effects
6 provisions identified: 0 benefits, 5 costs, 1 mixed.
New SF XXX and CUI Contract Clauses
The rule creates a new Standard Form (SF XXX) called Controlled Unclassified Information (CUI) Requirements and adds new solicitation/contract clauses (FAR 52.204-XX, 52.204-YY, and provision 52.204-WW). If the SF XXX indicates CUI, contractors must follow 32 CFR part 2002 handling rules and the contract clause, and must flow down CUI requirements to subcontractors.
Applies to SAT and Commercial Contracts
The proposed FAR changes apply to contracts at or below the Simplified Acquisition Threshold (SAT) and to commercial products and commercial services, but do not apply to contracts solely for commercially available off-the-shelf (COTS) items.
NIST SP 800‑171 Compliance Costs
Non‑defense contractors may be required to implement NIST SP 800-171 Revision 2; the RIA estimates an average initial labor cost for a small business of about $148,200 and recurring annual labor cost of about $98,800, plus estimated initial hardware/software costs of about $27,500 and $5,000 annually.
Enhanced NIST SP 800‑172 for ~160 Contractors
A limited set of contractors (about 160) may need to implement enhanced security in NIST SP 800-172; the RIA estimates total initial implementation costs of about $132,850,000 for those contractors, with individual estimates such as $202,500 initial cost for 100 small businesses (25–50 endpoints), $1,000,000 for 20 medium businesses, and $2,315,000 for 40 large businesses. Annual recurring costs are estimated at 20% of initial implementation.
8‑Hour Reporting and 90‑Day Image Preservation
If a contractor discovers or suspects a CUI incident, the contractor must notify the Government within 8 hours (unless a different timeframe is specified) and preserve system images and relevant monitoring/packet-capture data for 90 days so the Government can request them.
Mandatory CUI Training for Employees
Any contractor or subcontractor employee who handles CUI must complete training on safeguarding CUI as specified on the SF XXX; the rule estimates this training will take about one hour per employee and contractors must keep training records and provide evidence upon request.
Personalized for You
How does this regulation affect your finances?
Personalize government policy and PRIA will tell you what this federal register document means for your household, plus every other regulation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Key Dates
Related Federal Register Documents
2026-17822, Violations of Laws or Regulations
The Office of the Comptroller of the Currency (OCC) proposes to revise the supervisory framework for the issuance of matters requiring attention (MRAs) in response to violations of laws or regulations and for addressing violations for which the OCC does not take an enforcement action or issue an MRA.
2026-17902, Bicycle Use in Park Areas
The National Park Service (NPS) proposes to modify the procedural requirements in existing NPS regulations for the designation of roads and trails for bicycle use within park areas. The changes would align NPS regulations with applicable Federal law and policy, remove unnecessary requirements, and ensure public involvement when needed. The changes in this rule would allow the NPS to manage its resources and allocate taxpayer funds more efficiently and streamline the approval of new and expanded opportunities for use and enjoyment of park areas by the American public.
2026-17867, Amendment of Class D Airspace and Class E Airspace Over New Haven, CT
This action proposes to amend Class D and Class E airspace over New Haven, CT. This action would modify the dimensions of the New Haven, CT Class D airspace to appropriately contain Instrument Flight Rules (IFR) operations at the Tweed/New Haven Airport. This action would also update verbiage in the Class D airspace legal description to comply with current FAA guidance. This action would also update the airport name and geographic coordinates for Tweed/New Haven airport in both the Class D and Class E5 airspace legal descriptions. This action would also remove the exclusions for adjacent Class E5 airspace from the New Haven, CT Class E5 airspace legal description.
2026-17840, Airworthiness Directives; Airbus Helicopters
If you fly Airbus Helicopters Model SA330J, the FAA wants you to keep checking the main gearbox fan for gaps and replace parts if needed. They’re giving you more time to install a better fan bearing assembly that stops these checks. You can’t install certain parts unless they meet new rules, so keep an eye on deadlines to stay safe and legal!
2026-17871, Proposal of Special Measure Regarding Banque Misr UAE as a Financial Institution Operating Outside of the United States of Primary Money Laundering Concern
FinCEN is issuing a notice of proposed rulemaking, pursuant to section 311 of the USA PATRIOT Act, that finds the five United Arab Emirates-based branches of Banque Misr (collectively, Banque Misr UAE) to be of primary money laundering concern and proposes imposing a special measure to: prohibit U.S. financial institutions from opening or maintaining a correspondent account for, or on behalf of, Banque Misr UAE; require U.S. financial institutions to take reasonable steps not to process a transaction for the correspondent account in the United States of a foreign banking institution if such a transaction involves Banque Misr UAE; and require U.S. financial institutions to apply special due diligence to their foreign correspondent accounts that are reasonably designed to guard against their use to process transactions involving Banque Misr UAE.
2026-17767, Promoting Telehealth in Rural America
In this document, the Federal Communications Commission (Commission) seeks comments on the scope of the similar service and rural area comparability requirements, comments on possible improvements to, or replacements of, our existing cost study method of determining rural telecommunications rates, comments on possible methods of promoting the use of lower-cost technologies intended to provide backup services, comments on a proposal to establish an eligible services list for the Rural Health Care (RHC) Program, comments on whether to adopt performance metrics to expedite the processing of RHC Program funding requests, and comments on whether to eliminate the approval requirement of evergreen contracts and an annual report requirement.
Previous / Next Documents
Previous: 2024-29641, Endangered and Threatened Wildlife and Plants; Designation of Critical Habitat for the San Francisco Bay-Delta Distinct Population Segment of the Longfin Smelt
The U.S. Fish and Wildlife Service wants to protect the longfin smelt, a special fish living in the San Francisco Bay-Delta, by marking about 91,630 acres as critical habitat. This means certain activities in these areas might change to help the fish survive. People can share their thoughts by March 17, 2025, and an economic report is available to show how this might affect local businesses.
Next: 2024-30854, ADS-Equipped Vehicle Safety, Transparency, and Evaluation Program
The government is proposing a new program to keep an eye on cars with automated driving systems (ADS) to make sure they’re safe and transparent. Car makers can join voluntarily by sharing safety info and reports, helping everyone understand how these smart cars work on public roads. Comments on the plan are open until March 17, 2025, so the program can start shaping the future of driving safely and smartly.