Key Takeaways
- • The Federal Acquisition Regulatory Council issued a proposed rule on June 23, 2026, establishing uniform definitions and 72-hour reporting requirements for Controlled Unclassified Information (CUI) incidents across federal contractors and subcontractors, with comments due by July 23, 2026.
- • Subcontractors must now report CUI incidents directly to the government in addition to reporting to higher-tier contractors, expanding enforcement visibility and compliance risk across the entire supply chain.
- • The Department of Justice has recovered over $80 million in cybersecurity-related False Claims Act settlements since October 2021, with recent enforcement actions targeting NIST SP 800-171 control failures, signaling continued aggressive pursuit of contractor noncompliance.
- • Contractors must implement NIST Special Publication 800-171 Revision 3 and NIST SP 800-172 controls, and any cloud service providers handling CUI must meet security requirements equivalent to FedRAMP moderate authorization.
- • The proposed rule removes prescriptive one-size-fits-all training mandates in favor of flexible training requirements while standardizing definitions of CUI and CUI incidents aligned with National Archives and Records Administration regulations, materially increasing enforceability and litigation risk for non-compliant contractors.
Summary
The Federal Acquisition Regulatory Council's June 23, 2026 proposed rule will establish standardized requirements for how federal contractors and subcontractors handle Controlled Unclassified Information and report security incidents if finalized. The rule defines CUI as information created or possessed by the government or entities acting on its behalf that requires safeguarding or dissemination controls under applicable law or policy. Notably, the definition excludes federally-funded basic research at academic institutions under National Security Decision Directive 189 and contractor-created information not subject to specific safeguarding mandates.
A CUI incident is defined as unauthorized disclosure, improper modification, improper destruction of CUI, or unauthorized access to systems housing CUI—explicitly excluding improper handling such as unmarked documents unless such handling results in actual unauthorized disclosure or compromise. The proposed rule mandates reporting within 72 hours of discovery, aligning with existing Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 cyber incident reporting timelines. Significantly, subcontractors must report incidents directly to the government, not solely through prime contractors, creating direct enforcement exposure and visibility across supply chains.
The rule emphasizes implementation of NIST Special Publication 800-171 Revision 3 and NIST SP 800-172 controls when incorporated into contracts. Cloud service providers storing, processing, or transmitting CUI must meet FedRAMP moderate equivalent security requirements. The proposed rule replaces prescriptive training mandates with flexible training standards, allowing contractors discretion in compliance methods while maintaining standardized definitions and reporting obligations.
The timing is significant in the context of Department of Justice False Claims Act enforcement. DOJ has recovered over $80 million in cybersecurity-related settlements since October 2021, demonstrating sustained enforcement focus. On June 18, 2026, DOJ settled with LOGZONE for alleged failures to implement required NIST SP 800-171 controls on Navy contracts, discovered during a Defense Contract Management Agency assessment. Standardization of CUI definitions and reporting requirements will strengthen DOJ's enforcement posture by eliminating compliance ambiguity and creating uniform benchmarks against which contractor conduct can be measured.
Federal contractors and subcontractors should immediately assess CUI handling practices, evaluate current NIST 800-171 control implementation, ensure flowdown of obligations to the supply chain, and review incident response protocols. Organizations should engage legal counsel to assess potential reporting obligations under the False Claims Act and evaluate litigation risk, particularly where historical incidents or compliance gaps may exist. The comment period closes July 23, 2026, and finalization will likely accelerate enforcement actions based on the standardized framework.
A CUI incident is defined as unauthorized disclosure, improper modification, improper destruction of CUI, or unauthorized access to systems housing CUI—explicitly excluding improper handling such as unmarked documents unless such handling results in actual unauthorized disclosure or compromise. The proposed rule mandates reporting within 72 hours of discovery, aligning with existing Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012 cyber incident reporting timelines. Significantly, subcontractors must report incidents directly to the government, not solely through prime contractors, creating direct enforcement exposure and visibility across supply chains.
The rule emphasizes implementation of NIST Special Publication 800-171 Revision 3 and NIST SP 800-172 controls when incorporated into contracts. Cloud service providers storing, processing, or transmitting CUI must meet FedRAMP moderate equivalent security requirements. The proposed rule replaces prescriptive training mandates with flexible training standards, allowing contractors discretion in compliance methods while maintaining standardized definitions and reporting obligations.
The timing is significant in the context of Department of Justice False Claims Act enforcement. DOJ has recovered over $80 million in cybersecurity-related settlements since October 2021, demonstrating sustained enforcement focus. On June 18, 2026, DOJ settled with LOGZONE for alleged failures to implement required NIST SP 800-171 controls on Navy contracts, discovered during a Defense Contract Management Agency assessment. Standardization of CUI definitions and reporting requirements will strengthen DOJ's enforcement posture by eliminating compliance ambiguity and creating uniform benchmarks against which contractor conduct can be measured.
Federal contractors and subcontractors should immediately assess CUI handling practices, evaluate current NIST 800-171 control implementation, ensure flowdown of obligations to the supply chain, and review incident response protocols. Organizations should engage legal counsel to assess potential reporting obligations under the False Claims Act and evaluate litigation risk, particularly where historical incidents or compliance gaps may exist. The comment period closes July 23, 2026, and finalization will likely accelerate enforcement actions based on the standardized framework.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.