Controlled Unclassified Information Requirements for Enterprises

Controlled Unclassified Information rules now apply to far more than defense contractors. For enterprises handling federal information in 2026, the central task is to identify the data correctly, apply the rules attached to the contract, and prove that the required safeguards work.

Why CUI compliance has stopped being a defense-contractor problem

GSA's January 2026 compliance framework, the FAR Council's June 2026 proposed government-wide CUI rule, and NIST's May 2026 finalization of SP 800-172r3 are moving simultaneously. Together, they signal a broader federal expectation for protecting CUI, although they serve different purposes and do not all have the same legal status. Civilian contractors now face requirements that once drew most of their enforcement pressure from the defense supply chain. The rules now cover IT service providers, research institutions, and professional services firms.

Executive Order 13556, issued in November 2010, replaced over 100 agency-specific markings with a government-wide framework under NARA, which delegated oversight to its Information Security Oversight Office, or ISOO. Before that, labels such as For Official Use Only and Sensitive But Unclassified led to differences in how information was handled and left gaps in security. Yet practical enforcement remained concentrated around DFARS clause 252.204-7012 and NIST SP 800-171. The obligation now follows contract flow-down across company sizes and sectors, with no small-business exemption or civilian-agency carve-out.

What CUI actually is and what the CUI Registry determines

32 CFR § 2002.4(h) defines CUI through its government connection and legal authority. It covers information the government creates or possesses, or that an entity creates or possesses for or on behalf of the government, when a law, regulation, or government-wide policy requires or permits safeguarding or dissemination controls. An employee's judgment that something feels sensitive is not enough. The information must also fall outside classification under EO 13526 or the Atomic Energy Act. Information held entirely for a non-executive-branch entity's own purposes, without government origin or purpose, is not CUI.

NARA maintains the CUI Registry as the sole authoritative list of approved categories and their legal authorities. An enterprise cannot self-designate information outside that Registry as CUI. Common categories include privacy information, proprietary business information, export-controlled information, critical infrastructure information, and legal information. PII, PHI, and financial records become CUI when the government connection and safeguarding authority apply. Technical drawings and specifications can qualify as both export-controlled information under ITAR or EAR and CUI when held or created for government purposes.

The Registry also classifies information as CUI Basic or CUI Specified. CUI Basic uses the standard safeguards in 32 CFR Part 2002 when the underlying authority prescribes no additional handling rules. CUI Specified follows explicit controls in the authorizing statute or regulation, with Basic rules filling any gaps. Both can appear in the same project, so each piece of data needs classification against the Registry. DoD Cyber Awareness Challenge 2026 guidance also warns that aggregating DoD unclassified data can raise its sensitivity or even make it classified, a relevant boundary for shared data environments.

Who is now in scope and why the perimeter keeps widening

The affected organizations are defined by their work. The rules cover defense contractors that receive technical data packages and research institutions that carry out federally funded studies. IT service providers hosting federal systems and professional services firms handling procurement-sensitive information can also fall within it.

Civilian contractors are the major expansion point. DoD has imposed NIST SP 800-171-based requirements through DFARS since 2017, while many civilian contractors have operated without comparable mandates. GSA's January 2026 framework begins closing that gap, and the proposed FAR rule would extend the approach government-wide. GSA requirements could enter solicitations and new awards at contracting officer discretion without a formal phase-in period. Under the FAR proposal, contractors likewise have no basis to count on a formal phase-in that would give them more time.

The perimeter also extends through suppliers and acquisitions. Prime contractors must check that subcontractors that handle CUI meet the rules, and some already require Level 2 C3PAO certification for new purchase orders. Cloud providers handling CUI face FedRAMP Moderate authorization as the baseline. Buyers of businesses with federal contracts therefore need CUI compliance as a core diligence workstream, including for commercial technology providers and software vendors within defense supply chains. Scoping too narrowly can create False Claims Act exposure if the government disagrees.

The regulatory framework enterprises must navigate in 2026

32 CFR Part 2002, issued September 2016, sets the basic rules for the whole government. It governs designation, safeguarding, dissemination, marking, decontrol, and disposal. DFARS 252.204-7012 adds rules for defense contracts, including the duty to put NIST SP 800-171 into practice and report cyber incidents. The clause has been in force since 2016, with full implementation required by December 31, 2017. DoD class deviation 2026-O0025 locks defense contractors to Rev 2 until rescinded or incorporated into the FAR/DFARS, with a November 10, 2028 milestone for automatic CMMC clause insertion.

GSA's January 5, 2026 IT Security Procedural Guide takes a different path. It requires Revision 3, which contains 97 security requirements across 17 control families. Its five-phase framework centers on formal documentation and independent assessments rather than self-attestation, and it requires one-hour incident reporting. The FAR Council's June 23, 2026 proposed rule would establish a government-wide framework under FAR Part 40 using Rev 3 and a 72-hour reporting window. The FAR Council expects finalization before the end of 2026, but the proposal is not a final rule.

A GSA contractor and a DoD contractor can hold the same CUI while owing different control sets. Organizations that serve both must work out the scope of each requirement on its own and write down which revision applies to each system. Rev 3 adds three families that Rev 2 does not have: Planning, System and Services Acquisition, and Supply Chain Risk Management.

NIST finalized SP 800-172r3 on May 13, 2026, as a supplement to SP 800-171r3. It recommends stronger controls for CUI tied to high-value assets or critical programs that face Advanced Persistent Threats linked to nation-states. It now also covers supply chain security practices, access controls, network segmentation, and asset management. Separately, ISOO Notice 2026-08, dated September 2, 2026, tightened rules for limited agency marking waivers, legacy material marking waivers, and exigent circumstances waivers.

What NIST SP 800-171 actually requires enterprises to implement

GSA's authorization blockers make the technical baseline concrete. Access enforcement must be role-based and documented, remote access must be controlled, and multi-factor authentication must cover privileged and non-privileged accounts. Vulnerability monitoring and scanning, boundary communications protection, and cryptographic protection of CUI in transit are also required. Timely flaw remediation matters, and end-of-life components cannot remain in production environments. Any one of these failures can block authorization.

Rev 3 also demands precision in the policies behind those controls. Its 88 Organization-Defined Parameters require specific, documented policy values. Planning requires formal security plans. System and Services Acquisition adds written duties for the supply chain that can reveal what is missing when organizations buy and oversee services informally. A generic policy document is not evidence that these requirements have been met.

Identification and handling rules come before the technical safeguards. CUI must be properly marked at creation or receipt and stored only on authorized information systems. Personal email and unapproved mobile devices are not permitted transmission routes. When security is absent, physical CUI belongs in locked containers, desks, or cabinets.

Transmission and hosting add further conditions. Email that contains PII or other CUI must be encrypted, while sending it by fax requires confirmation of the recipient and the correct cover sheet. DoD Cyber Awareness Challenge 2026 identifies failure to encrypt email as the most commonly reported cause of PII breaches. Cloud providers must hold FedRAMP Moderate authorization, and GSA requires explicit subcontractor flow-down with primes accountable for supply chain security. Its one-hour incident deadline also demands a prepared response capability.

How enforcement has shifted from contract disputes to federal litigation

DOJ Deputy Assistant Attorney General Brenna Jenny described cyber enforcement as a “significant upward trajectory” on January 28, 2026. She reported recoveries of tens of millions of dollars across multiple False Claims Act cyber settlements in the prior year. The named cases show why implementation and documentation cannot be separated. A compliance assertion is vulnerable when either the safeguards or the written plan behind it is missing.

Georgia Tech Research Corporation settled in September 2025 after its Astrolavos Lab did DoD cyber-defense research without anti-virus tools or a System Security Plan. Morse Corp agreed to pay a multi-million-dollar sum in March 2025 to resolve allegations involving missing cybersecurity controls, a third-party email host that did not meet required security standards, and no written cybersecurity plan. That case also placed outsourced hosting within the compliance dispute. Moving the service outside the organization did not remove it from the allegations.

Under the False Claims Act, businesses can owe triple the government's actual damages plus fines for each claim. For defense contractors, each invoice submitted while relying on a cybersecurity certification known to be false can constitute a claim. An overstated self-assessment can therefore become evidence. The Georgia Tech and Morse Corp cases make the distinction plain, because written claims and actual implementation must match.

What the CMMC Phase 2 suspension does and does not change

The Pentagon's July 13, 2026 suspension of planned CMMC Phase 2 requirements raises a reasonable question about the direction of enforcement. Starting November 10, 2026, Phase 2 would have required third-party assessments for contracts that involve sensitive but unclassified information. The stated review sought alignment with the Acquisition Transformation System, lower barriers for smaller and non-traditional businesses, and more scalable cybersecurity measures. The SBA estimates that third-party certification can cost each small firm hundreds of thousands of dollars, a real barrier.

The suspension defers a verification mechanism. All Phase 1 self-assessment requirements remain in place. The Department stated that the action “does not eliminate the requirement for companies to protect federal data”. GSA's framework and the proposed FAR rule are also proceeding on separate tracks.

What a defensible CUI compliance posture looks like in practice

A defensible posture starts with sequence. Before choosing controls, map every data flow against the CUI Registry to find its category and whether CUI Basic or CUI Specified applies. Then document which contractual requirements and NIST revision govern each system. This prevents the control program from being built around the wrong information or the wrong standard. Identification and scoping establish the boundary that everything else depends on.

Within that boundary, address GSA's authorization blockers first. Implement MFA for all accounts, remove end-of-life production components, and encrypt CUI across transmission channels, including email. Use FIPS 140-2 validated cryptographic modules for CUI at rest. Document implementation in the System Security Plan and treat each applicable Organization-Defined Parameter as a required artifact. Subcontract agreements must reflect flow-down requirements, supported by evidence of active assessment.

Visibility must cover automated systems as well as people. Enterprises deploying AI agents into CUI workflows need access policies, role-based permissions, and real-time audit trails that treat each agent as an accountable identity, an emerging extension of the same control problem. Incident response then needs tested escalation paths and pre-authorized contacts suited to the actual one-hour or 72-hour reporting window. Governance built first lets enterprises extend automated workflows faster, because the controls provide the basis for approving production with safeguards already in place.