Topic · cui

CUI (32 CFR Part 2002)

Controlled Unclassified Information — the 32 CFR Part 2002 marking/handling regime and program-specific CUI categories.

RSS feed ↗

trade-press
Normal workflows push CUI past CMMC enclave boundaries
When CUI flows through collaboration platforms and subcontractor correspondence, the compliance surface expands beyond the enclave boundary that most preparation efforts are built around.
A Federal News Network commentary argues CMMC compliance programs share a blind spot: the assumption that CUI stays where you put it. In practice, controlled technical information propagates through Teams, email, cloud storage, and subcontractor correspondence as a byproduct of ordinary business. An organization can achieve certification and fall out of scope within days, not through policy failure, but through the normal velocity of project work.
SEP 1
trade-press
ChatGPT Mil goes live on Pentagon's GenAI.mil
The deployment brings CUI-safe generative AI to millions of DoD personnel, but the real story is the security architecture underneath, a model environment hardened to both DISA and NSA scrutiny.
The Pentagon's GenAI.mil platform now includes ChatGPT Mil, an OpenAI deployment built to support more than 3 million defense personnel for work involving controlled unclassified information. The model had to be engineered into a separate environment from the commercial product, with security architecture designed to pass scrutiny from both the Defense Information Systems Agency and the National Security Agency. Deployment lands roughly a month after OpenAI's June projection of "early July."
AUG 31
trade-press
DOD to shift CMMC to NIST 800-171 Rev. 3 with expanded assessment scope
The control count drops from 110 to 97, but assessment objectives jump past 420 and new supply-chain risk management requirements push compliance beyond IT's walls.
DOD is planning an interim final rule to transition CMMC Level 2 compliance from NIST SP 800-171 Revision 2 to Revision 3, reducing controls from 110 to 97 while expanding assessment objectives from 320 to roughly 420 and adding supply-chain risk management requirements. Presenters at an Aug. 25 NDIA webinar warned that supply-chain risk management isn't an IT function and that contractors treating 800-171 compliance as a security-team problem will find Rev. 3 especially punishing. No effective date has been set; the CMMC Reform Task Force delivers recommendations in mid-September, and DOD must still issue guidance on organization-defined parameters before contractors can fully align.
AUG 27
trade-press
CUI rules keep fracturing because the government isn't a business
Former GSA Administrator Emily Murphy says the push for commercial technology runs into procurement requirements that commercial buyers simply don't have.
Former GSA Administrator Emily Murphy told Federal News Network the government's push for commercial technology keeps colliding with the reality that agencies aren't commercial buyers. The fractured CUI landscape illustrates the problem: NIST publishes one standard, but DoD spent a decade building CMMC around it while GSA issued its own procedural guide and the FAR Council's government-wide rule remains unfinished. "We always say we want the government to act more like a business, but at the end of the day, the government isn't a business," Murphy said. The protest rights, cyber requirements, and socioeconomic rules that distinguish federal procurement aren't temporary.
AUG 25
trade-press
BlueVoyant exec: use CMMC pause to build enterprise monitoring
Lonny Anderson, a former CMMC skeptic, argues the Phase 2 suspension is the right moment to replace self-attestation with continuous external monitoring, and that reverting to the honor system while DOD deliberates is the real risk.
Former NSA chief technology officer Lonny Anderson, now president of BlueVoyant Government Solutions, published an open argument Wednesday urging the Defense Department to use the CMMC Phase 2 suspension to adopt an enterprise accountability model (independent assessment plus continuous external monitoring and shared remediation funding) rather than letting the pause lapse into pure self-attestation. The piece marks a public shift from CMMC skeptic to conditional supporter. Anderson's central claim: many NIST SP 800-171 failures, like expired TLS certificates and exposed misconfigured services, are visible from the outside right now, regardless of whether formal C3PAO assessments are running.
AUG 20
trade-press
NDIA: DoD's own CUI marking failures drive CMMC costs
The comment-period pause gives industry a rare opening to name the Pentagon's own CUI marking failures as the hidden cost driver in CMMC, not contractor immaturity.
NDIA told DoD during the CMMC reform comment window that inconsistent Pentagon CUI marking is the root cause of compliance costs running $100K to $5M+ for individual contractors. Nearly half of NDIA's survey respondents spent over $100,000 implementing NIST 800-171, costs that can't be amortized across contracts for small firms. The filing names what contractors have said quietly for years: you can't protect information the government itself can't consistently label.
AUG 19
trade-press
CMMC architect wants AI to sharpen CUI targeting
Katie Arrington says the standard shouldn't budge, but inconsistent CUI determinations across the defense industrial base are wasting money and leaving real exposure, and AI-assisted triage could fix the mismatch without touching the security bar.
Katie Arrington, who built the CMMC program, argues in a NextGov op-ed that the framework's requirements shouldn't loosen, but its targeting needs sharpening. CUI determinations remain inconsistent across the defense industrial base: some small businesses get assessed for data that isn't really CUI, while others handling sensitive material slide through with lighter requirements. Her fix: use AI to do first-pass sorting of contract language and CUI flow-down, with a human contracting officer making the final call. She also calls for a dedicated SBA loan program to fund cybersecurity investment at small businesses outside the defense supply chain.
AUG 17
trade-press
Cloudflare lands FedRAMP High, eyes DOD IL4
FedRAMP High and GovRAMP Moderate are real; the IL4 pursuit is still just a declared intention.
Cloudflare achieved FedRAMP High authorization Thursday, allowing civilian agencies to use its platform for High-impact data covering national security, critical infrastructure, financial systems, and other sensitive workloads. GovRAMP Moderate followed in April for state and local governments. The company also announced it plans to seek DOD Impact Level 4 authorization for CUI workloads, but that's a declared intention, not a review in progress. DISA issues IL4 provisional authorizations under the DoD Cloud Computing SRG, and Cloudflare hasn't begun that assessment process. DOE, HHS, Commerce, DHS, Interior, Justice, and State already use Cloudflare technologies.
AUG 10
trade-press
Salesforce Agentforce 360 clears DOD IL5 for CUI data
The authorization is a genuine compliance gate for CUI workloads, but the vendor's "first" framing ignores the eight companies already running AI at DOD's classified tiers.
Salesforce's Agentforce 360 platform received DOD Impact Level 5 authorization Wednesday, clearing it to store and process Controlled Unclassified Information and unclassified National Security Systems data across the department. The authorization, hosted on AWS GovCloud, puts Army Human Resources Command down as the first named customer. The IL5 milestone is a real compliance gate, but Salesforce's "first commercial software company bringing an agentic platform into national security" framing strains against the eight AI vendors DOD already has operating at the higher IL6 and IL7 classified tiers.
AUG 5
regulator
NARA CUI Registry codifies PRVCY marking for federal PII
The General Privacy category splits into basic and specified authority markings, but contractors inheriting agency PII should first check their agency's implementing policies, not just the registry.
NARA's CUI Registry lists the General Privacy category (PRVCY) with its associated safeguarding authorities and banner markings under the CUI program established by Executive Order 13556 and 32 CFR Part 2002. The category covers personal information as defined in OMB M-17-12 and "means of identification" under 18 USC 1028(d)(7). The registry distinguishes between basic authorities (which use CUI or the alternative banner CUI//PRVCY) and OMB M-17-12 as the listed specified authority, which carries CUI//SP-PRVCY. Agency personnel and contractors should consult their agency's CUI implementing policies for guidance; the registry is the Government-wide baseline, not a substitute for agency-level direction.
JUL 25
trade-press
Chamber Challenges Immediate 800-171 Rev. 3 Mandate in FAR CUI Rule
The absence of a phase-in period is operationally infeasible for most of the 67,000 affected contractors and may expose the rule to legal challenge under the Administrative Procedure Act, the Chamber argues.
The U.S. Chamber of Commerce filed comments opposing the FAR Council's proposed CUI rule, which would require contractors to comply with NIST SP 800-171 Rev. 3 immediately upon contract insertion with no phase-in period. The filing argues this is operationally infeasible for roughly 67,000 unique entities and more than 2 million private-sector employees, most of whom have never been subject to the 800-171 framework. The Chamber warns the absence of a phase-in period may render the rule vulnerable under the Administrative Procedure Act if the FAR Council cannot demonstrate that immediate compliance is feasible across the entire civilian contractor base.
JUL 24
independent
War Department pushes FOCI onto CUI contractors over $5M
The old clearance boundary is no longer the government’s comfort zone for foreign ownership risk.
The Department of War’s proposed Defense Federal Acquisition Regulation Supplement (DFARS) rule on foreign ownership, control, or influence (FOCI) closed for comment July 6. It would require primes and subs on covered unclassified sensitive work, including controlled unclassified information (CUI), over $5 million to disclose and mitigate FOCI, with award blocked for noncompliance and nearly 40,000 entities affected by DoW’s estimate. Congress is moving in parallel: the Senate Fiscal Year 2027 National Defense Authorization Act would drop the threshold to $500,000, while an undefined commercial-contract national-security override stays loose enough to slow deals.
JUL 15
trade-press
DoD suspends CMMC Phase 2 for 60-day review
A cost reprieve now leaves primes and subs guessing which cyber baseline DoD will actually buy against.
DoD said it suspended Cybersecurity Maturity Model Certification (CMMC) Phase 2 immediately, stopping the third-party certification launch set for Nov. 10 and halting Phases 3 and 4 during a 60-day reform review. Contractors, primes and subs keep Phase 1 self-assessments, with select government-led assessments. Small and mid-sized suppliers get breathing room; the defense industrial base now has an undefined compliance target.
JUL 13
independent
FAR Council consolidates supply-chain, CUI rules in Part 40 proposal
Putting CUI safeguarding in the FAR itself changes the compliance map more than the clause numbering suggests.
The FAR Council's June 23, 2026 Part 40 proposal would pull supply-chain security restrictions from FAR Parts 4, 25 and 40 into one structure, add FAR-wide Controlled Unclassified Information obligations, impose a uniform reasonable-inquiry standard, and set a 72-hour reporting window for supply-chain violations. Primes, subs and counsel get a central hub, but not yet a settled answer on how agency-specific CUI clauses will run alongside it.
JUL 13
trade-press
DoD fast-tracks CMMC shift to NIST 800-171 Rev. 3
DoD is trying to avoid another CMMC comment-cycle drag, leaving contractors to price work against an unnamed clock.
Inside Cybersecurity reports that the Defense Department’s 2026 unified agenda, published July 3, places an interim final rule in motion to move the Cybersecurity Maturity Model Certification program from National Institute of Standards and Technology Special Publication 800-171 Revision 2 to Revision 3 for controlled unclassified information. Primes, subcontractors and certified third-party assessment organizations get the practical problem: Rev. 2 assessments and contract planning now have an approaching shelf life, but DoD has not said when the clock starts or what happens after it expires.
JUL 8
trade-press
FAR Council proposes civilian CUI rule after 15-year gap
The proposal replaces agency improvisation with a contract-marking regime, then gives industry 30 days to parse the buried rewrite.
Federal News Network reports the FAR Council has proposed a government-wide controlled unclassified information (CUI) rule for civilian agencies, built around a standard form and contracting officer directions for identifying and marking CUI. Contractors, primes and subs would get one baseline for scope and flowdown; Cybersecurity Maturity Model Certification (CMMC) third-party assessment organizations (C3PAOs) will have to track the NIST SP 800-171 Revision 3 split from CMMC’s Revision 2 work. The rule still arrives inside the larger FAR overhaul with 30 days for comment, and its effective date and existing-contract treatment remain unresolved.
JUL 1
trade-press
DoD plans classified GenAI.mil expansion as users near 1.7M
The adoption story is nearly over, and the harder governance fight starts at controlled data, model choice and human review.
Nextgov reports the Department of Defense’s GenAI.mil platform has reached almost 1.7 million users and more than 100,000 custom agents. Cameron Stanley, DoD’s chief digital and artificial intelligence officer, said the department plans more models and higher classification levels; OpenAI has said ChatGPT will be eligible for controlled unclassified information (CUI) through GenAI.mil in July. For security and procurement teams, the meaningful shift is commercial models moving deeper into protected DoD workflows.
JUL 1
trade-press
FAR rewrite leaves CUI confusion intact
Consolidating clauses helps buyers find the rules; it does not tell contractors when agencies have triggered them.
Government Executive says the Federal Acquisition Regulation rewrite has not solved contractors’ recurring problem with controlled unclassified information: inconsistent agency implementation and unclear triggering facts. The FAR overhaul may consolidate information security and supply-chain provisions, but Executive Order 13556, National Archives and Records Administration CUI rules, NIST SP 800-171 and Cybersecurity Maturity Model Certification still sit outside that cleanup. The affected reader is not the policy shop. It is the bidder pricing cyber work before the solicitation tells them what data they will actually touch.
JUN 25
trade-press
FAR overhaul pushes CUI, FedRAMP clauses into rulemaking
This is not one procurement cleanup; it is three contractor security programs being rewritten on the same track.
FedScoop reports that four proposed Federal Acquisition Regulation rules, totaling more than 1,000 pages, are set for Federal Register publication and would revise 20 FAR sections for the first major update in 40 years. Primes, subs and contractors would face 72-hour cyber incident reporting, controlled unclassified information safeguarding changes, and at least a FedRAMP Moderate baseline when CUI sits in the cloud. Comments run through July 23, but the final schedule and phase-in remain unresolved.
JUN 22
judicial
LOGZONE pays $507,144 over Navy DFARS cyber failures
DOJ is converting DFARS control gaps into fraud exposure, which is a different problem than a bad assessment score.
LOGZONE Inc., a Huntsville, Alabama defense contractor, agreed to pay $507,144 to resolve False Claims Act liability for knowingly failing to meet DFARS cybersecurity requirements on Navy contracts. Primes, defense-industrial-base suppliers and counsel should read this as more than a contract compliance miss. DOJ’s Civil Cyber-Fraud Initiative is again treating covered defense information controls as payment-integrity conditions, with no public answer yet on whether any data was compromised.
JUN 18
trade-press
OpenAI plans early-July IL5 ChatGPT launch on GenAI.mil
At more than 3 million potential users, model access becomes a budget, workflow, and controlled unclassified information governance problem.
NextGov reports that OpenAI strategic delivery lead Mohammed Husain said ChatGPT is expected to go live on GenAI.mil in early July, certified for controlled unclassified information (CUI) and Department of Defense Impact Level 5 (IL5). The rollout would reach more than 3 million defense civilian and military personnel. The constraint Husain named was token economics: cost per completed task is becoming part of the control plan.
JUN 16
standards
NIST releases SP 800-172r3, tightening enhanced CUI controls
The third major revision in five years expands access control, network segmentation, asset management, and supply chain requirements, and no transition timeline for r2 contractors exists yet.
NIST published SP 800-172r3 and its companion assessment guide SP 800-172Ar3 on May 13, 2026, adding enhanced requirements across access control, network segmentation, asset management, and supply chain security for contractors handling controlled unclassified information (CUI) in nonfederal systems. Assessors must update evaluation procedures to match r3 or their assessments will be considered non-compliant. NIST has not announced a compliance deadline for contractors currently operating under r2, nor whether existing r2 assessments remain valid during any transition period.
MAY 23
regulator
Siemens Opcenter RDnL carries critical ActiveMQ auth flaw; patch now
All versions are affected; three mitigations are available while update packages roll out.
CISA published ICS advisory ICSA-26-134-09 covering CVE-2026-27446, a CVSS 7.1 missing-authentication flaw (CWE-306) in Apache ActiveMQ Artemis as shipped with Siemens Opcenter RDnL. All versions are affected. An adjacent-network attacker can force the broker to open an outbound Core federation connection to an attacker-controlled host, enabling message injection or exfiltration on any queue. Siemens recommends updating to Apache Artemis 2.52.0 or later; three interim mitigations cover Core interceptors, acceptor protocol restriction, and two-way SSL. Opcenter RDnL sits in critical manufacturing environments worldwide.
MAY 22