FAR CUI rule status: what Case 2026-001 proposes

As of September 30, 2026, the official sources reviewed for this tracker identify FAR Case 2026-001 as a proposed rule. The June 23, 2026 notice contains proposed CUI provisions, including clause 52.240-7. Acquisition.gov lists its comment period as closed on July 23, 2026. A closed comment period is not an effective date.

The practical starting point remains your current solicitation or contract. A proposal is useful for preparation, but it does not rewrite the clauses already incorporated into an agreement.

The dated record

Read the published Federal Register notice, rather than treating a predicted implementation date in a vendor article as binding. Check the official comment index alongside any later final rule or agency deviation.

This tracker does not establish whether a particular agency has already imposed comparable duties in its own contract. That needs a separate reading of the procurement package.

The notice identifies its legal stage on the first page:

ACTION: Proposed rule.

What the proposed clause would require

The following table describes the June 2026 proposal. Each row is conditional on the proposed text and its stated scope, not a claim that the provision applies government-wide today.

For non-DoD contracts, the proposed incident provision points to CISA. For DoD contracts, it names a DoD reporting destination. The same paragraph calls for notice to the contracting officer and the next higher-tier contractor, where applicable. Don’t assume a report to one recipient satisfies every applicable reporting obligation.

The proposal’s federal-system and federally controlled facility provisions also need separate attention. A contractor-operated agency system is not automatically the same case as the contractor’s own nonfederal network.

Prepare a comparison before commissioning a rebuild

In Deep Fathom’s view, a bounded gap comparison is a sensible preparation step. A full migration justified only by a forecast is harder to defend.

Keep the comparison small enough to answer a decision:

1. Copy the current incorporated clause, edition, applicable deviation, and amendment into the review record.
2. List the information and system boundary covered by that agreement.
3. Compare the current requirements with the June proposal, including agency-defined parameters and incident duties.
4. Separate work that improves the current implementation from work dependent on a future requirement.
5. Assign a monitoring owner and a decision date for any deferred migration.

This approach does not mean waiting to improve security. It makes the reason for each piece of work visible.

Use the procurement clause reading map for defense clauses and the NIST revision comparison for the standard question. Keep the agency’s actual text alongside both.

A contractor with two customers

Suppose a hypothetical supplier has a DoD contract and a separate civilian agency contract. Its security team wants one “federal compliance” checklist.

Start with two obligation records. For each, record the incorporated clause, revision, information, reporting recipient, and any approved exceptions. Only then identify common implementation work.

A shared system may support overlapping duties, but one customer’s clause doesn’t establish the other customer’s requirements. The proposed government-wide clause should be a third, explicitly prospective column until it becomes applicable to that supplier’s work.

Our suggested decision artifact is one page: current duties, proposed differences, no-regret actions, deferred actions, and the event that would change the decision.

What would change this tracker?

Recheck the source record when a final rule appears, an agency issues a relevant deviation, a solicitation is amended, or a contract modification introduces new terms. Record the effective date and applicability language from the actual instrument.

A headline announcing publication is insufficient to determine which contracts change. The effective date, applicability provisions, and incorporated language need their own review.

For CUI identification questions, consult NARA’s FAQ. For the separate defense safeguarding obligation, see the DFARS 7012 guide. A non-sensitive scope question can be sent through Deep Fathom contact without uploading the controlled information itself.