Will the FAR CUI rule require NIST 800-171 on civilian contracts?

If your firm designs or builds for GSA, the Army Corps of Engineers civil works program, the VA or other civilian agencies, the cybersecurity rules on those contracts have been lighter than on defense work. A pending FAR rule would change that by bringing NIST SP 800-171 into civilian contracts that involve Controlled Unclassified Information (CUI). As of October 17, 2026, that rule is still a proposal, and its details changed significantly in June 2026.

What is the FAR CUI rule?

It is a proposed governmentwide contract clause that would require contractors handling CUI on their own systems to protect it under NIST SP 800-171 and to report CUI incidents. The FAR Council first published it as FAR Case 2017-016 on January 15, 2025 (90 FR 4278), with comments due March 17, 2025.

The rule exists to carry out the federal CUI program that the National Archives (NARA) runs under Executive Order 13556. NARA's regulation at 32 CFR 2002.14(h)(2) already directs agencies to use NIST SP 800-171 when they set requirements for CUI on non-federal systems. What has been missing is a single FAR clause that puts that requirement into civilian contracts the same way DFARS 252.204-7012 does for defense contracts.

The January 2025 version proposed a new Standard Form XXX, "Controlled Unclassified Information (CUI) Requirements," that agencies would attach to solicitations and contracts to say whether CUI is involved, what must be protected and where incidents go. It also proposed reporting suspected or confirmed CUI incidents within 8 hours of discovery.

What changed in the June 2026 FAR overhaul proposal?

The CUI requirements were rewritten and moved into a new FAR Part 40 as part of the Revolutionary FAR Overhaul. The FAR Council published FAR Case 2026-001 at 91 FR 37550 on June 23, 2026, a proposed rule covering FAR Parts 1, 2, 4, 33, 39, 40 and 53, and listed FAR Case 2017-016 among the cases it "aims to consolidate." Comments closed July 23, 2026.

The changes that matter most to a firm's planning:

• NIST SP 800-171 Revision 3. The January 2025 proposal required Revision 2. The June 2026 version updates the SF XXX to identify organization-defined parameters for Revision 3, which NIST published in May 2024.
• 72-hour reporting. The 8-hour window is replaced with 72 hours from discovery, which the FAR Council says aligns with DFARS 252.204-7012 and the Cyber Incident Reporting for Critical Infrastructure Act of 2022.
• Where reports go. For DoD contracts, reports go to DIBNet. For non-DoD contracts, they go to CISA.
• New clause numbers. The CUI clause becomes FAR 52.240-7 and the notice provision becomes FAR 52.240-6. The earlier proposed clause on identifying potential CUI is dropped.
• Cloud services. A cloud provider storing CUI identified in the SF XXX would need to meet security requirements equivalent to the FedRAMP Moderate baseline.
• Narrower obligations elsewhere. The prescriptive training requirement and the contractor liability language are removed, and NIST SP 800-172 enhanced controls apply only when an agency identifies a critical program or high value asset.

The proposed clause would apply to commercial products and services but not to commercially available off-the-shelf (COTS) items, and it would flow down to subcontractors.

Is the FAR CUI rule final?

No. As of October 17, 2026, no final FAR CUI rule has been published in the Federal Register, and the June 2026 text remains a proposed rule. Nothing in it binds a contract until a final rule is issued and the clause is included in that contract.

The timeline has slipped before. The Spring 2025 Unified Agenda entry for RIN 9000-AN56 projected a final rule in December 2025. That RIN has not appeared in a later agenda, and the overhaul rule carries a new RIN, 9000-AO86. The FAR Council has not published a firm date for a final rule. Any date you hear for finalization is an estimate until it appears in the Federal Register.

The overhaul itself is still moving. A second batch of proposed rules covering 16 more FAR parts, including Part 36 on construction and architect-engineer contracts, was published September 18, 2026, with comments due October 19, 2026. The FAR overhaul page on acquisition.gov tracks each release.

Why does the Rev 2 versus Rev 3 question matter for AEC firms?

Because firms with both civilian and defense work could face two versions of the same standard at once. DoD's CMMC rule incorporates NIST SP 800-171 Revision 2 (February 2020) and assessment guide SP 800-171A (June 2018), while the proposed FAR clause points to Revision 3.

Revision 3 reorganizes the requirements, adds families such as supply chain risk management and uses organization-defined parameters that the government fills in. The June 2026 proposal says its parameters align with values DoD expects to codify in 32 CFR part 170 through its own rulemaking, which suggests the government intends the two tracks to converge. Until DoD finishes that rulemaking, a firm holding a GSA courthouse design contract and an Army Corps military construction contract could be documenting to Revision 3 for one agency and Revision 2 for another.

For most AEC firms, the systems are the same either way: the file server or cloud tenant holding drawings, the email system where specifications move, the collaboration platform shared with consultants. One well-built environment can usually be mapped to both revisions. What changes is the documentation and the evidence.

Which AEC contracts would be affected?

Under the proposal, the contracts affected would be those where the agency marks the SF XXX to say CUI is involved. The agency, not the contractor, decides whether information it provides or that you create for it is CUI.

That decision matters for design and construction work because federal facility projects often generate information agencies may protect, such as security layouts, building systems details and site information. The proposed rule does not list AEC project types. It relies on the agency's CUI designation in each contract, so the practical signal is the SF XXX in the solicitation package.

Firms that already hold DoD contracts with DFARS 252.204-7012 have a head start, since the proposed FAR clause also relies on NIST SP 800-171, uses the same 72-hour reporting window and applies an equivalent FedRAMP Moderate test to cloud services. Firms that work only for civilian agencies and have never been asked about NIST SP 800-171 are the ones most exposed to a new requirement.

What should AEC firms do this quarter?

Use the time before a final rule to understand where you stand, so a new clause in a solicitation is not a surprise. A reasonable sequence:

• Inventory contracts and pursuits. List current federal civilian and DoD contracts and active pursuits, and note any CUI markings, DFARS 252.204-7012 clauses or CUI language in task orders.
• Map where project information lives. Identify every system that stores or transmits drawings, models and specifications for federal projects, including subconsultant file exchanges.
• Run a gap assessment against Revision 3 and keep Revision 2 evidence. If you hold DoD work, your existing System Security Plan stays on Revision 2 while DoD assesses against it.
• Test your incident response plan against a 72-hour clock. Confirm who decides that an event is a reportable CUI incident and whether you know how to reach DIBNet and CISA.
• Check your cloud services. Confirm which platforms holding project files are FedRAMP Moderate authorized or equivalent.
• Talk to subconsultants. The proposed clause flows down, so structural, MEP and specialty consultants on federal projects would need their own controls.

None of this requires waiting for the final text. The underlying control set is published, and the June 2026 proposal shows the direction.

For the defense side of the same work, see how primes handle CMMC flow down requirements for subcontractors and which NIST 800-171 gaps to close first during the CMMC pause.

How does s90 help?

s90 manages IT, security and compliance documentation for AEC firms in Los Angeles and Orange County, including environments built to NIST SP 800-171. If you want a clear picture of how your current systems would line up against Revision 2 and Revision 3, and what a FAR CUI clause would mean for your federal pursuits, we are happy to walk through it with you.