The FAR Council has reissued the proposed FAR CUI rule as FAR Case 2026-001, replacing the docket number contractors have tracked since the rule was first proposed on January 15, 2025 as FAR Case 2017-016. The reissue is part of the broader Revolutionary FAR Overhaul rulemaking, which touches FAR Parts 1, 2, 4, 22, 39, 40, and 53. It was published in the Federal Register on June 23, 2026, and comments are due July 23, 2026.
This is still a proposed rule — nothing here is binding today. But the comment window is the moment to weigh in before the terms are locked, and compliance teams and procurement counsel should know exactly what moved since the January 2025 version.
How FAR Case 2026-001 Relates to the Original Proposal
The underlying policy goal has not changed: standardize how CUI is safeguarded and reported across federal contracts, the way FAR 52.204-21 already standardizes basic FCI safeguarding. What changed is the docket, the timeline, and four specific terms inside the clause. Contractors, compliance teams, and counsel who submitted comments on the January 2025 version should treat this as a new opportunity to comment — the earlier comment record does not carry forward automatically under the new case number.
Four Things That Changed
1. The incident-reporting window is now 72 hours, not 8. The January 2025 draft would have required reporting a CUI incident within 8 hours of discovery. The reissued rule extends that to 72 hours from discovery, reported through a CISA portal. DoD contracts would continue to use the DoD portal instead, and FedRAMP incidents keep their own existing reporting procedure rather than folding into this one. 2. The safeguarding standard would be NIST SP 800-171 Revision 3, not Revision 2. Contractors would need to protect CUI on non-federal systems using NIST SP 800-171 Rev. 3. DoD contracts currently require Rev. 2 under a standing class deviation, so if this rule finalizes before DoD updates its own requirement, there is a real possibility of a divergence period — DoD contractors on Rev. 2, civilian-agency contractors on Rev. 3, under two different rules citing the same underlying NIST standard. 3. A clause was deleted. The rule drops FAR 52.240-YY, which would have required contractors to identify and report potential CUI on contracts where no CUI is actually involved. Removing it narrows the rule's reach to contracts that actually carry CUI. 4. A new conflict-of-law notice was added. Contractors would gain a defined mechanism to notify the Contracting Officer within 72 hours of identifying a conflict between this clause and another law or regulation — a formal escape valve that the January 2025 draft did not include.
For the companion story on how this rulemaking also proposes a new FAR Part 40 and a rewritten CUI clause (FAR 52.240-7), see The FAR Overhaul's Next Move.
What "Proposed, Not Final" Means for You Today
A proposed rule is not a compliance obligation. Until a final rule publishes, your current contract clauses, your current NIST SP 800-171 revision requirement, and your current incident-reporting timelines are unchanged. Do not update your incident-response plan to a 72-hour clock, and do not start planning a Rev. 3 transition, on the strength of a proposed rule alone. What a proposed rule does deserve is your attention now, while the terms can still move — not your compliance program, yet.
What to Do Next
- Review the rule text on the Federal Register and identify which of the four changes above would affect your contracts, your incident-response plan, or your NIST SP 800-171 posture.
- Consider submitting a comment by July 23, 2026 — particularly on the reporting-window change, the Rev. 3 shift, or the new conflict-of-law notice, if any of them create a practical problem for your business.
- Watch for the final rule before assuming Rev. 3 applies. Continue meeting your current clause requirements (including NIST SP 800-171 Rev. 2 where your contract specifies it) until a final rule actually changes them.
Key Takeaways
- FAR Case 2026-001 (reissued June 23, 2026) reopens the proposed FAR CUI rule for comment through July 23, 2026, replacing the docket used since the January 2025 draft (FAR Case 2017-016).
- Four substantive changes from the January 2025 version: the CUI incident-reporting window extends from 8 to 72 hours; the safeguarding standard would shift to NIST SP 800-171 Rev. 3; the no-CUI reporting clause (FAR 52.240-YY) is deleted; and a new 72-hour conflict-of-law notice mechanism is added.
- This is a proposed rule only — no obligation changes until a final rule publishes. Contractors should review the text, weigh commenting by the deadline, and continue meeting current requirements in the meantime.
For how CUI safeguarding fits into your overall obligations, see Understanding CUI in Practice, the current standard on Frameworks, and your baseline duties on the FAR Baseline page. To see your full requirement set, use Find My Requirements.
---
Source: Federal Register — Federal Acquisition Regulation: Revolutionary Federal Acquisition Regulation Overhaul, Parts 1, 2, 4, 22, 39, 40, and 53 (FAR Case 2026-001), June 23, 2026. Secondary summary: Greenberg Traurig, "RFO Rulemaking Gives Contractors a Second Opportunity to Comment on FAR CUI Rule," GT Alert, June 29, 2026. Informational only, not legal advice; this is a proposed rule and may change before any final rule — verify all citations against the rule text and your solicitation.