Chamber Challenges Immediate 800-171 Rev. 3 Mandate in FAR CUI Rule
The absence of a phase-in period is operationally infeasible for most of the 67,000 affected contractors and may expose the rule to legal challenge under the Administrative Procedure Act, the Chamber argues.
TL;DR
The U.S. Chamber of Commerce filed comments opposing the FAR Council's proposed CUI rule, which would require contractors to comply with NIST SP 800-171 Rev. 3 immediately upon contract insertion with no phase-in period. The filing argues this is operationally infeasible for roughly 67,000 unique entities and more than 2 million private-sector employees, most of whom have never been subject to the 800-171 framework. The Chamber warns the absence of a phase-in period may render the rule vulnerable under the Administrative Procedure Act if the FAR Council cannot demonstrate that immediate compliance is feasible across the entire civilian contractor base.
The FAR Council's June 23 proposed rule (a 439-page overhaul mandated by Executive Order 14275) aims to streamline the Federal Acquisition Regulation into something simpler, clearer, and faster. The U.S. Chamber of Commerce appreciates the effort. What it doesn't appreciate is the part where contractors would have to comply with NIST SP 800-171 Rev. 3 the moment the CUI clause appears in a contract.
No runway for 67,000 contractors
The Chamber's July 22 filing focuses on one section of the sprawling rulemaking: the standardized CUI requirements for civilian agencies. The core objection is the absence of a phase-in period. Under the proposal, once the rule is finalized, NIST SP 800-171 Rev. 3 compliance would be required immediately upon contract insertion, no transition runway, no Plans of Action and Milestones to bridge gaps. The Chamber estimates roughly 67,000 unique entities and more than 2 million private-sector employees fall within the rule's scope. Most of those civilian contractors have never been subject to the 800-171 framework at all, let alone the Rev. 3 updates finalized by NIST in 2024. Asking them to achieve full compliance at contract award, the Chamber argues, is "operationally infeasible."
The APA card
The filing goes further, framing the issue as a potential Administrative Procedure Act problem. If the FAR Council can't demonstrate that immediate compliance is feasible for 67,000 entities, the rule's lack of a phase-in period "may be legally vulnerable to challenge." That's not an idle observation, it signals industry is prepared to litigate if the final rule doesn't include a realistic compliance pathway. The Chamber also notes the 30-day comment period for a 439-page rule was itself "insufficient to ensure meaningful public participation under the APA."
Scope, gaps, and training
Beyond the phase-in problem, the Chamber objects to the rule's scope. The proposal applies CUI requirements to nearly all commercial acquisitions, leaving only a narrow carve-out for commercial off-the-shelf items. That's inconsistent, the Chamber says, with the FAR overhaul's stated goal of reducing regulatory burden and with the statutory preference for commercial item acquisition. On the technical transition from NIST SP 800-171 Rev. 2 to Rev. 3, the Chamber asks the FAR Council to either provide a detailed gap analysis with a transition period, or allow Rev. 2 compliance to satisfy the requirement for a defined window after finalization. The filing also flags concerns about CUI marking liability and calls for a single set of government-wide CUI training materials rather than duplicative agency-specific requirements.
The FAR Council must now reconcile its streamlining mandate with the operational reality described in the Chamber's filing. For compliance directors and contracting officers watching this rulemaking, the open question is whether the final rule will include a phased compliance runway, or whether they'll be expected to hit Rev. 3 compliance the day the clause lands.
Published ·Deep Fathom