# 2024-30437: Federal Acquisition Regulation: Controlled Unclassified Information 2024-30437, Federal Acquisition Regulation: Controlled Unclassified Information, is a Federal Register proposed rule from an unnamed agency published 2025-01-15, effective Comments must be submitted on or before March 17, 2025. (as of 2026-06-11). - Canonical: https://policyrisk.com/federal-register/2024-30437 - As of: 2026-06-11 - Plain-text twin of the page above; the HTML and this file carry the same facts. ## Facts - Document number: 2024-30437 - Title: Federal Acquisition Regulation: Controlled Unclassified Information - Type: Proposed Rule - Agencies: unknown - Citation: unknown - Published: 2025-01-15 - Effective: Comments must be submitted on or before March 17, 2025. - Comments close: not stated - Significant: no - Touches household money: no - Regulation identifier numbers: none - Last updated: 2026-06-11 ## Summary The Department of Defense, GSA, and NASA want to update rules to better protect Controlled Unclassified Information (CUI) in government contracts. This means contractors handling sensitive but not secret info will follow new security steps. Comments on these changes are open until March 17, 2025, so get ready to share your thoughts—this could affect how contracts are managed and might add some costs for compliance. ## Abstract DoD, GSA, and NASA are proposing to amend the Federal Acquisition Regulation (FAR) to implement the National Archives and Records Administration's Controlled Unclassified Information Program enacted under an Executive Order entitled Controlled Unclassified Information. ## Effects PRIA read - New SF XXX and CUI Contract Clauses: mixed, high. The rule creates a new Standard Form (SF XXX) called Controlled Unclassified Information (CUI) Requirements and adds new solicitation/contract clauses (FAR 52.204-XX, 52.204-YY, and provision 52.204-WW). If the SF XXX indicates CUI, contractors must follow 32 CFR part 2002 handling rules and the co… - Applies to SAT and Commercial Contracts: cost, high. The proposed FAR changes apply to contracts at or below the Simplified Acquisition Threshold (SAT) and to commercial products and commercial services, but do not apply to contracts solely for commercially available off-the-shelf (COTS) items. - 8‑Hour Reporting and 90‑Day Image Preservation: cost, medium. If a contractor discovers or suspects a CUI incident, the contractor must notify the Government within 8 hours (unless a different timeframe is specified) and preserve system images and relevant monitoring/packet-capture data for 90 days so the Government can request them. - Mandatory CUI Training for Employees: cost, low. Any contractor or subcontractor employee who handles CUI must complete training on safeguarding CUI as specified on the SF XXX; the rule estimates this training will take about one hour per employee and contractors must keep training records and provide evidence upon request. - NIST SP 800‑171 Compliance Costs: cost, high. Non‑defense contractors may be required to implement NIST SP 800-171 Revision 2; the RIA estimates an average initial labor cost for a small business of about $148,200 and recurring annual labor cost of about $98,800, plus estimated initial hardware/software costs of about $27,500 and $5,000 annual… - Enhanced NIST SP 800‑172 for ~160 Contractors: cost, high. A limited set of contractors (about 160) may need to implement enhanced security in NIST SP 800-172; the RIA estimates total initial implementation costs of about $132,850,000 for those contractors, with individual estimates such as $202,500 initial cost for 100 small businesses (25–50 endpoints),… ## Related documents - [2026-20735](https://policyrisk.com/federal-register/2026-20735): Extensions of Credit to Insiders, 2026-10-09 - [2026-20790](https://policyrisk.com/federal-register/2026-20790): Application of the Personal Responsibility and Work Opportunity Reconciliation Act of 1996 to the Refunded Portion of Certain Federal Refun…, 2026-10-09 - [2026-20721](https://policyrisk.com/federal-register/2026-20721): Requirements for Additional Traceability Records for Certain Foods: Enforcement Policy for Certain Retail Food Establishments and Restauran…, 2026-10-09 - [2026-20650](https://policyrisk.com/federal-register/2026-20650): Low-Value Shipments, 2026-10-08 - [2026-20660](https://policyrisk.com/federal-register/2026-20660): Optional Practical Training Fees, 2026-10-08 - [2026-20677](https://policyrisk.com/federal-register/2026-20677): Airworthiness Directives; Various Helicopters, 2026-10-08 ## Sources - [2024-30437 on federalregister.gov](https://www.federalregister.gov/documents/2025/01/15/2024-30437/federal-acquisition-regulation-controlled-unclassified-information) - [2024-30437 as published (PDF)](https://www.govinfo.gov/content/pkg/FR-2025-01-15/pdf/2024-30437.pdf) ## Related - [Previous: 2024-29641, Endangered and Threatened Wildlife and Plants; Designation of Critical Habitat…](https://policyrisk.com/federal-register/2024-29641) - [Next: 2024-30854, ADS-Equipped Vehicle Safety, Transparency, and Evaluation Program](https://policyrisk.com/federal-register/2024-30854) - [All Federal Register documents](https://policyrisk.com/federal-register) Source: PRIA, https://policyrisk.com/federal-register/2024-30437 (as of 2026-06-11).