Skip to content
Talk to an Advisor
Talk to an Advisor
Written by: Ketan Patel | Senior Vice President, Compliance

CUI Rules Are Changing Under FAR Part 40: How to Track the Timeline

CUI Graphics_300 x 300
Do you Handle controlled unclassified information (CUI)?

Most defense contractors don’t realize how often they come across CUI in everyday work. In two minutes, learn if your company may already handle CUI and what to do next.

<strong>TAKE THE CUI QUIZ</strong>
Listen: FAR Part 40 CUI Rules: How to Track the Timeline
7:46

Executive Brief

A new Controlled Unclassified Information (CUI) rule is moving through federal rulemaking, and its reach extends well past the defense industrial base.

The Federal Acquisition Regulation (FAR) Part 40 proposed rule would create a unified CUI standard across federal agencies. ISI built a status tracker so contractors can follow every milestone in one place.

  • Status: Proposed June 23, 2026, in the Federal Register. The public comment period closed July 23, 2026.
  • Who it covers: The vast majority of government contractors and subcontractors that store, process, transmit, or generate CUI.
  • Standard: National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Revision 3 (Rev. 3). The Cybersecurity Maturity Model Certification (CMMC) program uses Revision 2 (Rev. 2).
  • Assessments: Each agency decides how to validate contractor compliance.
  • CMMC: Remains required on contracts that carry the CMMC clauses, including those issued by the Department of Defense (DoD) (also known as the Department of War).
  • Timeline: ISI estimates final rule publication around April 30, 2027.

Dig deeper below to learn more.

Why It Matters

FAR Part 40 is part of the Revolutionary FAR Overhaul initiative. The proposed amendment includes a section dedicated to CUI handling and accounts for DoD contracts.

  • It absorbed the earlier FAR CUI rule and incorporated the public comments filed on it.
  • It extends CUI safeguarding expectations to contractors who have never worked under defense clauses.
  • It may reshape the clauses DoD contractors work under today, including Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012.

From the 2025 Proposal to FAR Part 40

The path to FAR Part 40 started with an earlier proposal. Here is how the two compare.

  • January 15, 2025: The proposed FAR CUI rule published in the Federal Register. It aligned with NIST SP 800-171 Rev. 2 and included a proposed standard form listing the types of CUI covered by a contract.
  • March 17, 2025: The comment period closed with fewer than 100 comments.
  • June 23, 2026: FAR Part 40 proposed the CUI section, folded in the earlier feedback, and moved the standard to Rev. 3.
  • July 23, 2026: The comment period closed. This specific part of the overhaul covered Parts 1, 2, 4, 33, 39, 40, and 53, and only 90 public comments.

ISI Insight: the low comment volume may point to limited awareness among non-defense contractors about the requirements ahead.

How FAR Part 40 Relates to CMMC

The two work at different layers, and the distinction shapes your planning.

  • FAR Part 40 sets a CUI safeguarding standard across most civilian and defense agencies.
  • CMMC verifies compliance with NIST SP 800-171 Rev. 2 on DoD contracts that include the CMMC clauses.
  • The contractual duty to safeguard CUI comes from clauses such as DFARS 252.204-7012, which FAR Part 40 may replace or alter.
  • CMMC requirements stay in force while the CMMC rules under Title 32 of the Code of Federal Regulations (32 CFR) Part 170 and Title 48 of the Code of Federal Regulations (48 CFR) are active and DFARS 252.204-7012, 252.204-7021, and 252.204-7025 appear in contracts.

For the latest on CMMC enforcement, read CMMC Phase II Is Paused, Not Canceled: What Defense Contractors Need to Know. For obligations that continue during the pause, read The CMMC Level 2 Pause Doesn’t Mean a Pause on Compliance.

Assessments Under FAR Part 40

FAR Part 40 does not require third-party assessments. The proposed language leaves validation to each agency.

  • Each agency will determine how it validates contractor compliance with NIST SP 800-171 Rev. 3.
  • Contractors serving multiple agencies may see different validation approaches.
  • CMMC could become a tool that agencies use to support FAR Part 40 in the future.

What Could Come Next

Here’s how the rule could ripple through existing requirements.

  • DFARS clauses and the CMMC programmatic rule at 32 CFR Part 170 could change.
  • If DFARS clauses such as 252.204-7012 eventually point to FAR Part 40, 32 CFR Part 170 would need new rulemaking to adopt scoring methodology and Plan of Action and Milestones (POA&M) guidance built on Rev. 3.
  • The proposal aligns with the administration’s goal of reducing and streamlining federal regulations.

How to Track the Timeline

Rulemaking moves in stages. The government must now adjudicate public comments and fold reasonable changes into a final rule, and no set timetable exists for that work.

  • Estimated final rule: April 30, 2027. The estimate follows the CMMC rulemaking pace, where the final rule published roughly nine months after the comment period ended.
  • Primary sources: The Federal Register and the FAR Council.

Our FAR Part 40 status tracker keeps all of this in one place. Each page shows:

  • The status, last review date, and next milestone
  • Who the rule applies to
  • What we know and what we do not know yet
  • What to do now
  • Our read on potential impacts
  • A dated status history explaining “why it matters” for every change

What to Do Now

 

 

FAQs

Is FAR Part 40 replacing CMMC?

No. FAR Part 40 may replace or alter DFARS 252.204-7012, the DoD’s current CUI safeguarding requirement. CMMC verifies compliance with NIST SP 800-171 Rev. 2, and the contractual duty to safeguard CUI comes from clauses such as 7012.

Will CMMC compliance still be mandatory when FAR Part 40 revisions go into effect?

Yes. If the CMMC 32 CFR and 48 CFR rules are active and DFARS 252.204-7012, 252.204-7021, and 252.204-7025 appear in contracts, companies on those contracts must meet CMMC requirements. DoD will likely keep or amend these rules to align with FAR Part 40.

Does FAR Part 40 require third-party assessments like CMMC?

No. CMMC applies to one department, while FAR Part 40 extends across most civilian and defense agencies. The proposed language lets each agency decide how to validate contractor compliance.

Who must follow FAR Part 40?

The rule applies to all government contractors and subcontractors that store, process, transmit, or generate CUI.

When will the final rule publish?

No official date exists. We estimate April 30, 2027, based on the CMMC rulemaking timeline. Follow the FAR Part 40 status tracker for updates.

Helpful ISI Links

Related Posts