Ernest Hemingway once wrote about bankruptcy that it happens “gradually and then suddenly.” The same can be said about federal information safeguarding rules. The Cybersecurity Maturity Model Certification (“CMMC”) program has been around for seven years. The Controlled Unclassified Information (“CUI”) program for over 15 years. Information safeguarding used to be a slow process with progress measured in years. Not anymore.
Over the past three months, the federal government has issued a wave of proposed rules designed to better safeguard federal information and harden contractor information systems.
FOCI Rule for Non-Cleared Contractors
The Department of Defense (“DoD”) issued a proposed rule in May 2026 that would significantly expand Foreign Ownership, Control, and Influence (“FOCI”) reporting requirements beyond the cleared contractor community, reaching existing and prospective contractors and subcontractors at any tier with DoD contracts or subcontracts exceeding five million dollars, even where no classified information is involved.
The rule would establish a new DFARS Part 240, “Information Security and Supply Chain Security,” and require covered offerors to submit an SF-328, Certificate Pertaining to Foreign Interests, and supporting information through the Defense Counterintelligence and Security Agency’s (“DCSA”) National Industrial Security System (“NISS”) before award. DoD describes the rule as intended to provide an “unprecedented level of visibility” into contractor ownership structures and to close a perceived gap through which foreign adversaries could access sensitive unclassified information, intellectual property, and critical technologies. The proposed requirements would also impose ongoing update obligations, including reporting changes that may place a contractor or subcontractor under FOCI within three business days, responding to DCSA risk determinations, implementing mitigation measures within specified timelines, and ensuring that covered subcontractors maintain eligible NISS status throughout performance.
Although the rule generally would not apply to commercial products and services, DoD would reserve authority for a designated senior official to require disclosures for certain commercial contracts involving sensitive data, systems, or processes. For many non-cleared contractors, the proposal would represent a first encounter with DCSA, NISS, and FOCI mitigation concepts, making early review of ownership structures, SF-328 responses, subcontractor coverage, and NISS registration a practical near-term compliance priority.
Updated FAR CUI Rule
In June 2026, the FAR Council issued an updated CUI rule as part of the Revolutionary FAR Overhaul. The proposed rule preserves the central architecture of the original rule proposed in January 2025 while moving the CUI requirements into the new FAR Part 40 framework and implementing them through a new provision, FAR 52.240-6, Notice of Controlled Unclassified Information Requirements, and a new clause, FAR 52.240-7, Controlled Unclassified Information.
As with the original rule, the proposed rule would apply to all contracts, including commercial contracts, that involve CUI. Only commercially available off-the-shelf item contracts are exempt. Under the proposed rule, agencies would remain responsible for identifying the CUI involved in the contract on Standard Form XXX. Contractors would be required to safeguard only the CUI identified on that form, subject to the clause’s procedures for unmarked, mismarked, or newly identified CUI.
The updated rule also includes a number of important changes from the original rule:
- Contractor information systems that store, process, or transmit CUI must now comply with NIST SP 800-171 Revision 3. The previous rule required compliance with NIST SP 800-171 Revision 2. The rule gives agencies the discretion to include a third-party verification requirement like DoD’s CMMC third-party assessors.
- Cloud service providers handling CUI on non-federal systems must meet security requirements equivalent to the FedRAMP Moderate baseline.
- The updated rule extends the deadline for CUI incident reporting and unmarked or mismarked CUI reporting from eight hours to 72 hours; narrows the definition of a CUI incident so that improper handling alone is not reportable unless it results in unauthorized disclosure, improper modification, improper destruction, or unauthorized system access; and removes the earlier language specifying contractor liability for CUI incidents.
- The updated proposal also identifies concrete reporting channels—DIBNet for DoD contracts, CISA for non-DoD contracts, and FedRAMP incident procedures for covered FedRAMP-authorized cloud service providers—while requiring subcontractors to report directly to the government and notify the contracting officer and next higher-tier contractor.
Post-Quantum Cryptography
In June 2026, President Trump issued an executive order (“EO”), Securing the Nation Against Advanced Cryptographic Attacks, that would begin moving federal contractors toward a governmentwide post-quantum cryptography compliance regime. The EO directs the FAR Council to propose acquisition rules requiring covered contractors to comply, by December 31, 2030, with NIST Federal Information Processing Standards (“FIPS”) that include post-quantum cryptography algorithms. The EO is aimed at addressing the risk that adversaries may collect protected U.S. information now and decrypt it later using large-scale quantum computers, and it establishes a federal policy of transitioning federal information systems to NIST-approved post-quantum cryptography standards.
For contractors, the practical effect is likely to be new FAR-based obligations to inventory cryptographic assets, assess whether products and systems rely on vulnerable or non-FIPS-approved cryptography, and plan for migration to quantum-resistant algorithms, particularly where contractor systems support federal high-value assets, high-impact systems, or other sensitive federal missions. The EO also directs the FAR Council to propose updates to contractor vulnerability disclosure program requirements to ensure that covered contractors implement vulnerability disclosure policies that address cryptographic vulnerabilities.
CMMC Phase 2 Pause and Transition to NIST SP 800-171 Revision 3
DoD made two important announcements in July 2026 regarding its CMMC program: (1) DoD announced an indefinite pause of CMMC Phase 2; and (2) DoD announced its intent to transition the CMMC program from NIST SP 800-171 Revision 2 to NIST SP 800-171 Revision 3.
CMMC Phase 2 was slated to begin in November 2026. Under Phase 2, DoD contractors and subcontractors would be required to have a third-party assessment (i.e., a C3PAO assessment) confirming their compliance with NIST SP 800-171 Rev. 2 to be eligible for new DoD contracts that involve the use of Defense CUI. As a result of the pause, DoD will—for now—only require contractors and subcontractors to self-assess their compliance with these safeguarding controls. DoD will also convene a task force to review the CMMC program and propose ways to reform it in a manner that prioritizes speed and lowers barriers to entry for small and non-traditional defense contractors. Critically, the pause only delays the requirement for a third-party assessment. It does not exempt contractors from existing CUI safeguarding regulations such as DFARS 252.204-7012, which are still in effect.
In addition to the Phase 2 pause, DoD has also announced that CMMC will transition to NIST SP 800-171, Revision 3. DoD’s CMMC program currently requires any contractor information system that stores, processes, or transmits CUI to comply with NIST SP 800-171 Revision 2. With this most recent announcement, covered DoD contractors and subcontractors should start preparing to implement the new controls and other requirements under Revision 3. DoD has not yet announced a timeline for the transition to Revision 3, but DoD may opt for an accelerated transition given that the FAR CUI rule, as currently proposed, requires non-DoD contractors to comply with Revision 3.
Contractors Must Continue to Prioritize Information Security
The days of gradual changes to information-safeguarding requirements are over. As the pace of technological change accelerates, so do contractors’ safeguarding requirements. Contractors must continue to monitor proposed updates to federal information-safeguarding rules and prepare to implement those updates. Otherwise, contractors may find themselves ineligible for new contracts and out of compliance with their existing contracts.