Topic · cui

CUI (32 CFR Part 2002)

Controlled Unclassified Information — the 32 CFR Part 2002 marking/handling regime and program-specific CUI categories.

RSS feed ↗

trade-press
Chamber Challenges Immediate 800-171 Rev. 3 Mandate in FAR CUI Rule
The absence of a phase-in period is operationally infeasible for most of the 67,000 affected contractors and may expose the rule to legal challenge under the Administrative Procedure Act, the Chamber argues.
The U.S. Chamber of Commerce filed comments opposing the FAR Council's proposed CUI rule, which would require contractors to comply with NIST SP 800-171 Rev. 3 immediately upon contract insertion with no phase-in period. The filing argues this is operationally infeasible for roughly 67,000 unique entities and more than 2 million private-sector employees, most of whom have never been subject to the 800-171 framework. The Chamber warns the absence of a phase-in period may render the rule vulnerable under the Administrative Procedure Act if the FAR Council cannot demonstrate that immediate compliance is feasible across the entire civilian contractor base.
YESTERDAY
independent
War Department pushes FOCI onto CUI contractors over $5M
The old clearance boundary is no longer the government’s comfort zone for foreign ownership risk.
The Department of War’s proposed Defense Federal Acquisition Regulation Supplement (DFARS) rule on foreign ownership, control, or influence (FOCI) closed for comment July 6. It would require primes and subs on covered unclassified sensitive work, including controlled unclassified information (CUI), over $5 million to disclose and mitigate FOCI, with award blocked for noncompliance and nearly 40,000 entities affected by DoW’s estimate. Congress is moving in parallel: the Senate Fiscal Year 2027 National Defense Authorization Act would drop the threshold to $500,000, while an undefined commercial-contract national-security override stays loose enough to slow deals.
JUL 15
trade-press
DoD suspends CMMC Phase 2 for 60-day review
A cost reprieve now leaves primes and subs guessing which cyber baseline DoD will actually buy against.
DoD said it suspended Cybersecurity Maturity Model Certification (CMMC) Phase 2 immediately, stopping the third-party certification launch set for Nov. 10 and halting Phases 3 and 4 during a 60-day reform review. Contractors, primes and subs keep Phase 1 self-assessments, with select government-led assessments. Small and mid-sized suppliers get breathing room; the defense industrial base now has an undefined compliance target.
JUL 13
independent
FAR Council consolidates supply-chain, CUI rules in Part 40 proposal
Putting CUI safeguarding in the FAR itself changes the compliance map more than the clause numbering suggests.
The FAR Council's June 23, 2026 Part 40 proposal would pull supply-chain security restrictions from FAR Parts 4, 25 and 40 into one structure, add FAR-wide Controlled Unclassified Information obligations, impose a uniform reasonable-inquiry standard, and set a 72-hour reporting window for supply-chain violations. Primes, subs and counsel get a central hub, but not yet a settled answer on how agency-specific CUI clauses will run alongside it.
JUL 13
trade-press
DoD fast-tracks CMMC shift to NIST 800-171 Rev. 3
DoD is trying to avoid another CMMC comment-cycle drag, leaving contractors to price work against an unnamed clock.
Inside Cybersecurity reports that the Defense Department’s 2026 unified agenda, published July 3, places an interim final rule in motion to move the Cybersecurity Maturity Model Certification program from National Institute of Standards and Technology Special Publication 800-171 Revision 2 to Revision 3 for controlled unclassified information. Primes, subcontractors and certified third-party assessment organizations get the practical problem: Rev. 2 assessments and contract planning now have an approaching shelf life, but DoD has not said when the clock starts or what happens after it expires.
JUL 8
trade-press
FAR Council proposes civilian CUI rule after 15-year gap
The proposal replaces agency improvisation with a contract-marking regime, then gives industry 30 days to parse the buried rewrite.
Federal News Network reports the FAR Council has proposed a government-wide controlled unclassified information (CUI) rule for civilian agencies, built around a standard form and contracting officer directions for identifying and marking CUI. Contractors, primes and subs would get one baseline for scope and flowdown; Cybersecurity Maturity Model Certification (CMMC) third-party assessment organizations (C3PAOs) will have to track the NIST SP 800-171 Revision 3 split from CMMC’s Revision 2 work. The rule still arrives inside the larger FAR overhaul with 30 days for comment, and its effective date and existing-contract treatment remain unresolved.
JUL 1
trade-press
DoD plans classified GenAI.mil expansion as users near 1.7M
The adoption story is nearly over, and the harder governance fight starts at controlled data, model choice and human review.
Nextgov reports the Department of Defense’s GenAI.mil platform has reached almost 1.7 million users and more than 100,000 custom agents. Cameron Stanley, DoD’s chief digital and artificial intelligence officer, said the department plans more models and higher classification levels; OpenAI has said ChatGPT will be eligible for controlled unclassified information (CUI) through GenAI.mil in July. For security and procurement teams, the meaningful shift is commercial models moving deeper into protected DoD workflows.
JUL 1
trade-press
FAR rewrite leaves CUI confusion intact
Consolidating clauses helps buyers find the rules; it does not tell contractors when agencies have triggered them.
Government Executive says the Federal Acquisition Regulation rewrite has not solved contractors’ recurring problem with controlled unclassified information: inconsistent agency implementation and unclear triggering facts. The FAR overhaul may consolidate information security and supply-chain provisions, but Executive Order 13556, National Archives and Records Administration CUI rules, NIST SP 800-171 and Cybersecurity Maturity Model Certification still sit outside that cleanup. The affected reader is not the policy shop. It is the bidder pricing cyber work before the solicitation tells them what data they will actually touch.
JUN 25
trade-press
FAR overhaul pushes CUI, FedRAMP clauses into rulemaking
This is not one procurement cleanup; it is three contractor security programs being rewritten on the same track.
FedScoop reports that four proposed Federal Acquisition Regulation rules, totaling more than 1,000 pages, are set for Federal Register publication and would revise 20 FAR sections for the first major update in 40 years. Primes, subs and contractors would face 72-hour cyber incident reporting, controlled unclassified information safeguarding changes, and at least a FedRAMP Moderate baseline when CUI sits in the cloud. Comments run through July 23, but the final schedule and phase-in remain unresolved.
JUN 22
judicial
LOGZONE pays $507,144 over Navy DFARS cyber failures
DOJ is converting DFARS control gaps into fraud exposure, which is a different problem than a bad assessment score.
LOGZONE Inc., a Huntsville, Alabama defense contractor, agreed to pay $507,144 to resolve False Claims Act liability for knowingly failing to meet DFARS cybersecurity requirements on Navy contracts. Primes, defense-industrial-base suppliers and counsel should read this as more than a contract compliance miss. DOJ’s Civil Cyber-Fraud Initiative is again treating covered defense information controls as payment-integrity conditions, with no public answer yet on whether any data was compromised.
JUN 18
trade-press
OpenAI plans early-July IL5 ChatGPT launch on GenAI.mil
At more than 3 million potential users, model access becomes a budget, workflow, and controlled unclassified information governance problem.
NextGov reports that OpenAI strategic delivery lead Mohammed Husain said ChatGPT is expected to go live on GenAI.mil in early July, certified for controlled unclassified information (CUI) and Department of Defense Impact Level 5 (IL5). The rollout would reach more than 3 million defense civilian and military personnel. The constraint Husain named was token economics: cost per completed task is becoming part of the control plan.
JUN 16
standards
NIST releases SP 800-172r3, tightening enhanced CUI controls
The third major revision in five years expands access control, network segmentation, asset management, and supply chain requirements, and no transition timeline for r2 contractors exists yet.
NIST published SP 800-172r3 and its companion assessment guide SP 800-172Ar3 on May 13, 2026, adding enhanced requirements across access control, network segmentation, asset management, and supply chain security for contractors handling controlled unclassified information (CUI) in nonfederal systems. Assessors must update evaluation procedures to match r3 or their assessments will be considered non-compliant. NIST has not announced a compliance deadline for contractors currently operating under r2, nor whether existing r2 assessments remain valid during any transition period.
MAY 23
regulator
Siemens Opcenter RDnL carries critical ActiveMQ auth flaw; patch now
All versions are affected; three mitigations are available while update packages roll out.
CISA published ICS advisory ICSA-26-134-09 covering CVE-2026-27446, a CVSS 7.1 missing-authentication flaw (CWE-306) in Apache ActiveMQ Artemis as shipped with Siemens Opcenter RDnL. All versions are affected. An adjacent-network attacker can force the broker to open an outbound Core federation connection to an attacker-controlled host, enabling message injection or exfiltration on any queue. Siemens recommends updating to Apache Artemis 2.52.0 or later; three interim mitigations cover Core interceptors, acceptor protocol restriction, and two-way SSL. Opcenter RDnL sits in critical manufacturing environments worldwide.
MAY 22