FAR Council consolidates supply-chain, CUI rules in Part 40 proposal
Putting CUI safeguarding in the FAR itself changes the compliance map more than the clause numbering suggests.
TL;DR
The FAR Council's June 23, 2026 Part 40 proposal would pull supply-chain security restrictions from FAR Parts 4, 25 and 40 into one structure, add FAR-wide Controlled Unclassified Information obligations, impose a uniform reasonable-inquiry standard, and set a 72-hour reporting window for supply-chain violations. Primes, subs and counsel get a central hub, but not yet a settled answer on how agency-specific CUI clauses will run alongside it.
The Part 40 proposal is a structural move, not just a renumbering exercise. Covington describes a FAR Council proposal that would gather supply-chain risk sharing, security prohibitions and exclusions, and safeguarding rules into one Part 40 framework. Today, those obligations sit across FAR Parts 4, 25 and 40, with the current Part 40 carrying little beyond American Security Drone Act requirements. The proposed rule makes Part 40 the place contractors would look first for federal procurement security obligations.
The supply-chain side gets both consolidation and some substantive cleanup. Proposed Subpart 40.2 would collect restrictions tied to products, services, transactions, the American Security Drone Act, Section 889 of the FY19 National Defense Authorization Act, and Federal Acquisition Supply Chain Security Act exclusion and removal orders into FAR 52.240-3. It would also apply a uniform reasonable-inquiry requirement and a 72-hour reporting timeframe across supply-chain security restrictions. Covington notes that reasonable inquiry means reviewing accessible information in the offeror's or contractor's possession, without requiring an internal or third-party audit.
The bigger shift is Controlled Unclassified Information. The current FAR has Federal Contract Information safeguarding in Part 4 and no specific FAR-wide CUI safeguarding rule, while CUI obligations have largely arrived through agency rules such as the Defense Federal Acquisition Regulation Supplement. Proposed Subpart 40.3 would add CUI and covered federal information safeguarding policies and procedures, implemented through FAR 52.240-6, FAR 52.240-7 and Standard Form XXX for procurements requiring CUI handling, except commercially available off-the-shelf items.
For contractors, the useful work is mapping. Primes and subs should compare current Section 889, FASCSA, drone, Federal Contract Information and agency-specific CUI procedures against the proposed Part 40 structure, including representations, flowdowns, incident reporting playbooks and CUI handling workflows. Covington's account does not specify a comment deadline or implementation date, and it leaves open how far existing agency-specific CUI rules would be superseded or continue as parallel requirements.
Published ·Deep Fathom