Preparing for CUI Obligations Before a Rule Finalizes

The governmentwide FAR rule on Controlled Unclassified Information is proposed, not final, and no one can tell you with certainty when or in what form it will take effect. That does not mean you have nothing to do, because contractors already carry CUI obligations today through individual agency clauses, through contract terms, and through the safeguarding language buried in solicitations you have already signed.

The useful posture is neither panic nor waiting. It is getting your house in order using the requirements that already bind you, so that a final rule, whenever it arrives, is a documentation exercise rather than a rebuild.

What Is Actually Required of Civilian Contractors Today?

There is no single governmentwide FAR clause that standardizes CUI handling across all civilian agencies. What exists instead is a patchwork.

The executive branch CUI program itself is established by Executive Order 13556 and implemented for agencies by 32 CFR Part 2002, with NARA acting as the executive agent and maintaining the CUI Registry of categories. Those authorities direct agencies. They reach contractors when an agency writes the requirement into a contract.

Several civilian agencies have done exactly that through their own supplements and clauses. The Department of Homeland Security, for example, addresses safeguarding of sensitive information through its HSAR clauses, and other civilian agencies have adopted their own approaches. The practical consequence is that your obligation depends on which agency you sell to and which clauses appear in your specific award or task order. Two contractors with the same GSA Schedule can owe materially different things.

What Does the Proposed FAR CUI Rule Try to Change?

The proposed rule, developed under FAR Case 2017-016, would replace that patchwork with standardized governmentwide requirements for identifying, marking, safeguarding, and reporting on CUI in federal contracts. In broad terms it contemplates standard contract clauses, a standard form used by the agency to identify what CUI is involved in a given contract, training expectations, and incident reporting timelines.

Two things are worth saying plainly. First, the rule is proposed and the final content can change in response to public comment, which is the normal function of the rulemaking process. Second, the timing is not settled, and anyone giving you a confident date for a final rule is guessing.

If it finalizes in a form resembling the proposal, the largest shift for civilian contractors is not a brand new duty. It is that the government would be expected to tell you clearly, up front, when a contract involves CUI, and you would be expected to have a defensible answer about how you protect it.

Does This Mean Civilian Contractors Need CMMC?

No, and this is the single most common confusion we see.

CMMC is a Department of War program. It applies through defense acquisition regulation to contractors handling covered defense information and CUI on defense contracts, and it involves defined assessment levels and, at higher levels, third party certification. It is a defense construct with a defense assessment ecosystem behind it.

On the civilian side there is no equivalent certification program. There is no civilian CMMC, no civilian certificate to hang on the wall, and no accreditation body that can bless your GSA Schedule as CUI compliant. If a vendor implies otherwise, that is a sales claim rather than a regulatory fact.

What civilian contractors do encounter is the underlying security standard. NIST SP 800-171 is the widely referenced baseline for protecting CUI in nonfederal systems, and civilian agency clauses frequently point to it. Understanding 800-171 is useful. Believing you can be certified against it on the civilian side is not.

What Can You Do Now That Will Not Be Wasted?

Preparation that pays off regardless of how the rule finalizes tends to be preparation that is really just good contract hygiene.

1. 1

   Review your existing contracts.

   Read the clauses in your existing awards and task orders and identify which ones already impose safeguarding, marking, or incident reporting duties. Many contractors discover obligations they have been carrying without noticing.

2. 2

   Map your data.

   Know where government information actually lives in your environment: which systems, which cloud services, which laptops, which subcontractors and which email threads. Most CUI failures are not sophisticated. They are information sitting somewhere no one accounted for.

3. 3

   Work the basics.

   Access control, multifactor authentication, encryption in transit and at rest, logging, and a written incident response process with a named owner and a phone tree that has been tested at least once. Assign one person accountable for CUI questions so that when a contracting officer asks, there is an answer rather than a search party.

4. 4

   Write things down.

   A system security plan and a plan of action for known gaps are valuable even before any rule requires them, because they turn scattered practice into evidence.

How Should You Handle CUI in Your Supply Chain?

Flowdown is where preparation quietly breaks. If a subcontractor, reseller, or software provider touches government information, your protections are only as strong as theirs.

Inventory who in your chain sees what. Confirm that safeguarding language flows down where your prime contract requires it, and be specific about what you expect rather than pasting a clause and hoping. Ask providers where data is stored and processed, and get the answer in writing.

This work is slow and it does not photograph well, but it is the part that is hardest to fix under deadline pressure after a rule finalizes.

What Should You Avoid Doing?

Avoid overcommitting in proposals. Do not represent compliance with a standard you have not implemented, and do not claim a certification status that does not exist on the civilian side. Representations about cybersecurity posture are contract representations, with the consequences that implies.

Avoid buying a large compliance platform on the theory that a proposed rule guarantees a specific future requirement. The rule may change. Fundamentals such as knowing your data, controlling access, and documenting your practices will survive any version of it.

And avoid treating silence as safety. If your contract already contains agency safeguarding language, your obligation is present tense today, entirely independent of what the FAR does next.

Frequently Asked Questions

Is the FAR CUI rule currently in effect?

No. The governmentwide FAR CUI rule, developed under FAR Case 2017-016, remains a proposed rule and has not been finalized. Contractors are not bound by its terms today. They are bound by whatever CUI and safeguarding clauses already appear in their individual contracts and task orders.

Do civilian contractors need CMMC certification?

No. CMMC is a Department of War program applied through defense acquisition regulations and does not apply to civilian agency contracts. There is no equivalent certification program on the civilian side, and no body that can certify a GSA Schedule holder as CUI compliant. Civilian obligations come from agency clauses in the contract itself.

Does NIST SP 800-171 apply to my civilian contract?

It depends on your contract. NIST SP 800-171 is the commonly referenced standard for protecting CUI in nonfederal systems, and several civilian agencies reference it in their own clauses, but it does not apply automatically to every civilian award. Check the clauses in your specific contract rather than assuming either way.

Who decides whether my contract involves CUI?

The agency does. Under the CUI program, the government is responsible for identifying and marking CUI and for telling contractors when a contract involves it. The proposed FAR rule would formalize that communication through a standard identification form, but until then, ask your contracting officer directly if the contract is ambiguous.

What is the single most useful preparation step right now?

Knowing where government information lives in your environment, including subcontractors and cloud services. Nearly every other control depends on that inventory, and it is the step that takes the longest to complete honestly. It is also useful regardless of how the proposed rule finalizes.

When will the FAR CUI rule be final?

That is not settled. Rulemaking timelines shift, and the content of a final rule can differ from the proposal after public comments are considered. Treat any specific promised date as speculation rather than fact.