FAR CUI Proposal Signals Major Compliance Expansion for Federal Contractors
The federal government has issued a sweeping proposed rule that could significantly reshape cybersecurity and compliance obligations for federal contractors that handle Controlled Unclassified Information (CUI). If finalized, the new Federal Acquisition Regulation (FAR) provisions would establish a governmentwide framework governing how contractors identify, safeguard, report, and manage CUI across civilian and defense contracts, while imposing substantial new compliance responsibilities that extend far beyond existing requirements such as the Department of Defense’s current cybersecurity rules. For contractors that do business with the federal government, the proposed rule signals an important shift toward more uniform and significantly more demanding CUI compliance obligations. A Governmentwide CUI Framework Is Taking Shape Historically, cybersecurity and information protection requirements related to sensitive government information have varied significantly across agencies. While...