Federal Acquisition Regulation: Controlled Unclassified Information
Published Date: 1/15/2025
Proposed Rule
Summary
The Department of Defense, GSA, and NASA want to update rules to better protect Controlled Unclassified Information (CUI) in government contracts. This means contractors handling sensitive but not secret info will follow new security steps. Comments on these changes are open until March 17, 2025, so get ready to share your thoughts—this could affect how contracts are managed and might add some costs for compliance.
Analyzed Economic Effects
6 provisions identified: 0 benefits, 5 costs, 1 mixed.
New SF XXX and CUI Contract Clauses
The rule creates a new Standard Form (SF XXX) called Controlled Unclassified Information (CUI) Requirements and adds new solicitation/contract clauses (FAR 52.204-XX, 52.204-YY, and provision 52.204-WW). If the SF XXX indicates CUI, contractors must follow 32 CFR part 2002 handling rules and the contract clause, and must flow down CUI requirements to subcontractors.
Applies to SAT and Commercial Contracts
The proposed FAR changes apply to contracts at or below the Simplified Acquisition Threshold (SAT) and to commercial products and commercial services, but do not apply to contracts solely for commercially available off-the-shelf (COTS) items.
NIST SP 800‑171 Compliance Costs
Non‑defense contractors may be required to implement NIST SP 800-171 Revision 2; the RIA estimates an average initial labor cost for a small business of about $148,200 and recurring annual labor cost of about $98,800, plus estimated initial hardware/software costs of about $27,500 and $5,000 annually.
Enhanced NIST SP 800‑172 for ~160 Contractors
A limited set of contractors (about 160) may need to implement enhanced security in NIST SP 800-172; the RIA estimates total initial implementation costs of about $132,850,000 for those contractors, with individual estimates such as $202,500 initial cost for 100 small businesses (25–50 endpoints), $1,000,000 for 20 medium businesses, and $2,315,000 for 40 large businesses. Annual recurring costs are estimated at 20% of initial implementation.
8‑Hour Reporting and 90‑Day Image Preservation
If a contractor discovers or suspects a CUI incident, the contractor must notify the Government within 8 hours (unless a different timeframe is specified) and preserve system images and relevant monitoring/packet-capture data for 90 days so the Government can request them.
Mandatory CUI Training for Employees
Any contractor or subcontractor employee who handles CUI must complete training on safeguarding CUI as specified on the SF XXX; the rule estimates this training will take about one hour per employee and contractors must keep training records and provide evidence upon request.
Personalized for You
How does this regulation affect your finances?
Personalize government policy and PRIA will tell you what this federal register document means for your household, plus every other regulation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Key Dates
Related Federal Register Documents
2026-20735, Extensions of Credit to Insiders
The FDIC is giving banks and insiders more time to share their thoughts on new rules about loans to insiders by extending the comment deadline to November 4, 2026. These rules aim to keep lending fair and safe, especially when insiders like executives or board members borrow money. If you’re involved with banks or interested in fair lending, now’s your chance to speak up before the final rules are set!
2026-20790, Application of the Personal Responsibility and Work Opportunity Reconciliation Act of 1996 to the Refunded Portion of Certain Federal Refundable Tax Credits; Hearing Cancellation
The IRS canceled a public hearing set for October 14, 2026, about new rules on how certain refunded tax credits count as federal benefits under a 1996 law. This affects individuals who get refundable tax credits, clarifying how those refunds are treated but with no immediate money changes. Since no one signed up to speak, the hearing won’t happen, but the proposed rules are still out for public comment.
2026-20721, Requirements for Additional Traceability Records for Certain Foods: Enforcement Policy for Certain Retail Food Establishments and Restaurants; Draft Guidance for Industry; Availability
The FDA is sharing a draft plan about new food tracking rules that mostly won’t apply to certain stores and restaurants right now. If you run a retail food place or restaurant, you don’t have to worry about extra paperwork just yet, but the FDA wants your feedback by November 23, 2026. This helps them decide the final rules without causing extra costs or hassle for small businesses.
2026-20650, Low-Value Shipments
The U.S. Customs and Border Protection is proposing new rules to make importing low-value goods (under $2,500) easier and more electronic, especially for mail shipments. They want to add new data requirements for carriers and require bonds for some shipments to keep things safe and smooth. If you’re involved in shipping or receiving small packages, get ready to adapt by December 7, 2026, when comments on these changes close.
2026-20660, Optional Practical Training Fees
Starting soon, international students using Optional Practical Training (OPT) will face new fees: $70,000 for their first OPT and $30,000 for any extra OPT periods. This change aims to stop fraud and protect U.S. workers. If you want to share your thoughts, make sure to comment by November 9, 2026!
2026-20677, Airworthiness Directives; Various Helicopters
The FAA wants to update rules for helicopters with radio altimeters because 5G signals in Canada can mess with their readings. Pilots will need to follow new flight manual limits when flying in Canadian airspace to keep things safe. Comments on this change are open until November 23, 2026, and it mainly affects helicopter operators flying near Canada.
Previous / Next Documents
Previous: 2024-29641, Endangered and Threatened Wildlife and Plants; Designation of Critical Habitat for the San Francisco Bay-Delta Distinct Population Segment of the Longfin Smelt
The U.S. Fish and Wildlife Service wants to protect the longfin smelt, a special fish living in the San Francisco Bay-Delta, by marking about 91,630 acres as critical habitat. This means certain activities in these areas might change to help the fish survive. People can share their thoughts by March 17, 2025, and an economic report is available to show how this might affect local businesses.
Next: 2024-30854, ADS-Equipped Vehicle Safety, Transparency, and Evaluation Program
The government is proposing a new program to keep an eye on cars with automated driving systems (ADS) to make sure they’re safe and transparent. Car makers can join voluntarily by sharing safety info and reports, helping everyone understand how these smart cars work on public roads. Comments on the plan are open until March 17, 2025, so the program can start shaping the future of driving safely and smartly.