FAR CUI rule re-proposed: 72-hour reporting and NIST 800-171 Rev 3

On 23 June 2026 the FAR Council re-proposed its rule on controlled unclassified information (CUI) as part of the Revolutionary FAR Overhaul, under FAR Case 2026-001. Comments were due 23 July 2026. It is a proposed rule, not a final one, and the sources we reviewed state no effective date. Nothing in it binds contractors today.

What's affected

According to Greenberg Traurig and Wiley summaries of the proposal:

• Scope: contracts where the contractor handles CUI, including commercial products and services, except commercially available off-the-shelf items.
• New text: FAR 52.240-6, a solicitation notice, and FAR 52.240-7, the contract clause, in an expanded FAR Part 40.
• Incident reporting moves from eight hours in the January 2025 proposal to 72 hours from discovery. Reports go to a CISA portal for civilian contracts and to DoD's DIBNet for defense contracts. Evidence must be preserved for at least 90 days.
• Security requirements: NIST SP 800-171 Revision 3 for contractor systems that handle CUI. DoD currently uses Revision 2 under a class deviation, so the two may be out of step for a time.
• Cloud services would need to meet requirements equivalent to the FedRAMP Moderate baseline. Incidents at FedRAMP-authorized providers that follow FedRAMP procedures need no extra report.
• Subcontracts involving CUI would carry the clause, and subcontractors would report incidents directly to the Government.
• The definition of a CUI incident no longer includes "suspected" incidents. SBOMs are not mentioned in the summaries.

What to do now

1. Treat the 72-hour figure as a planning target, not a duty. Confirm your current obligation under any DFARS clause already in your contracts.
2. Compare your controls to NIST SP 800-171 Rev 3, since that is the proposed baseline.
3. List which of your cloud tools handle CUI and whether they hold a FedRAMP authorization.
4. Watch for a final rule and check whether the comment period was reopened.

How suppliers can prepare

• Write an incident timeline that starts at discovery and has a named decision-maker, so 72 hours is realistic.
• Capture forensic images and logs by default so the 90-day preservation duty is met without a scramble.
• Map each CUI system to its Rev 2 and Rev 3 controls once, and keep one evidence set for both.
• Check subcontractors can report on their own clock and tell you at the same time.

Quick check

Sources

• Greenberg Traurig: RFO rulemaking gives contractors a second opportunity to comment on FAR CUI rule
• Wiley: FAR Council proposes revised CUI framework as part of Revolutionary FAR Overhaul