The FAR CUI Rule: Coming for Civilian Contractors Too
A proposed FAR clause would extend CUI protection requirements — and NIST SP 800-171 — to contractors working with civilian agencies like NASA, HHS, and the Department of State.
CMMC is a DoD requirement. But the underlying CUI protection obligation — NIST SP 800-171 — is being extended to the civilian government sector through a proposed Federal Acquisition Regulation (FAR) rule.
Read the full analysis: The FAR CUI Rule: What Federal Contractors Need to Know.
What the proposed FAR rule includes
- ✓A new clause (FAR 52.204-XX) requiring contractors to implement NIST SP 800-171 when handling CUI for any federal agency
- ✓Applies to NASA, HHS, EPA, State Department, and all other civilian agencies with CUI in their contracts
- ✓Self-assessment and score posting in SPRS (or an equivalent system)
- ✓Incident reporting requirements similar to DFARS 7012
Current status
As of mid-2026, the FAR CUI rule is still in the rulemaking process. Final rule publication is expected in 2026 or 2027. Contractors who are already compliant with NIST SP 800-171 for DoD work will be well-positioned for civilian compliance when the rule finalizes.
Strategic implication
Ready to start your CMMC journey?
Book a free 30-minute call with Rick to get a straight answer on where you stand and what to do next.
More in DFARS & Legal