The FAR CUI Rule is proposed, not final, and government-wide — not a CMMC rule. It does not change your obligation. If you handle CUI on a Department of War contract, you still self-assess against NIST SP 800-171 Rev 2, post your score to SPRS, and affirm it — exactly as before.
Three different things happened to the acquisition rulebook in 2026, and they are getting blended into one anxious question: "did my CMMC requirement just change?" The FAR clauses were renumbered. A government-wide FAR CUI Rule moved into formal rulemaking. And CMMC Phase 2 was suspended. Each is real. None of them changes what you actually have to do today. This guide untangles the FAR CUI Rule specifically — what it is, what it regulates versus what CMMC requires, and why it doesn't move your deadline.
What the FAR CUI Rule actually is
The FAR CUI Rule (FAR Case 2017-016) is a long-pending effort to write a single, government-wide standard for handling Controlled Unclassified Information into the Federal Acquisition Regulation — the rulebook that applies to every federal agency, civilian and defense alike. It implements the National Archives (NARA) CUI Program. It was first published as a proposed rule on January 15, 2025, then reissued as an updated proposed rule on June 23, 2026 as part of the "Revolutionary FAR Overhaul," with public comments due July 23, 2026. The FAR Council — the joint DoD, GSA, and NASA body that maintains the FAR — has signaled it intends to finalize the overhaul rules, including this one, before the end of 2026.
Its centerpiece is a standard form (referred to in the drafts as SF XXX, "Controlled Unclassified Information Requirements") that a contracting officer attaches to tell you, on any contract: whether CUI is involved, which categories, where it will reside, and the safeguarding and reporting rules that apply. In plain terms, the FAR CUI Rule is mostly about identifying and communicating CUI consistently — and about giving civilian agencies the uniform framework that the Department of War has had for years through DFARS 252.204-7012.
What the FAR CUI Rule regulates vs. what CMMC requires
These are two different layers of the same problem, and they stack rather than compete. One says "here is CUI, and here is the baseline for protecting it." The other says "prove you actually protect it."
| The FAR CUI Rule | CMMC / NIST 800-171 | |
|---|---|---|
| Whose rule | Government-wide (all federal agencies) via the FAR | Department of War, via the DFARS |
| What it does | Identifies, marks, and communicates CUI (the SF XXX form) and sets a uniform safeguarding baseline | Verifies you meet NIST SP 800-171 — self-assessment, SPRS score, annual affirmation |
| The clause | A new FAR CUI clause (proposed) | DFARS 252.204-7012 (safeguarding) & 252.204-7021 (CMMC) — unchanged |
| Status | Proposed rule; comments due Jul 23, 2026; not in effect | In force today on contracts that carry the clause |
| Your job | Nothing yet — it's a draft | Self-assess all 110 controls, post to SPRS, affirm annually |
For a Department of War contractor, the FAR CUI Rule complements what you already do; it doesn't replace it. The Department of War's own safeguarding and CMMC clauses (7012 and 7021) sit untouched underneath. So even after the FAR CUI Rule is final, your CMMC Level 2 path — self-assess, score, affirm — is the same path.
The "Basic self-assessment was eliminated" confusion
Here's where a lot of contractors take a wrong turn. When the 2026 FAR Overhaul renumbered the CMMC clauses (effective Feb 1, 2026), it also rewrote the old DFARS 252.204-7020 into the new DFARS 252.240-7997. The rewrite dropped the definition of the "Basic" (contractor self-assessment) from that clause — it now describes only government-performed Medium and High assessments.
Read too fast, that sounds like "self-assessment was eliminated." It wasn't. The self-assessment obligation moved conceptually into the CMMC program itself — DFARS 252.204-7021 — which was not renumbered and was not suspended. If your contract requires CMMC Level 2 (Self), you still perform the self-assessment; it just no longer lives in the 7020/7997 clause. Same work, different filing cabinet.
What did NOT change (the part that matters most)
- DFARS 252.204-7012. Safeguarding CUI and 72-hour cyber-incident reporting are exactly where they were.
- DFARS 252.204-7021. The CMMC requirement clause — the one that carries your required level into a solicitation — was not renumbered and not suspended.
- Your CMMC level and path. Handle CUI → still Level 2. Handle only FCI → still Level 1.
- SPRS. You still score yourself against all 110 controls, post the result to SPRS, and sign the annual affirmation.
- The scoring standard. CMMC and SPRS still run on NIST SP 800-171 Revision 2 — the Department of War has not moved scoring to Rev 3.
New rules, same 110 controls — see where you stand
The paperwork around CUI is being reorganized. The controls under it aren't. Score yourself against all 110 in about 10 minutes, free and in your browser.
Calculate your SPRS score →The one thing worth watching: Rev 3
There is a real wrinkle for the long term. The proposed FAR CUI clause points to NIST SP 800-171 Revision 3 for its own safeguarding requirement — not Revision 2. That does not change anything today: it's a draft, and CMMC/SPRS scoring remains on Rev 2. But if the FAR CUI Rule is finalized as written, it is the most likely path by which Rev 3 arrives government-wide, and it would raise the question of whether the Department of War aligns CMMC to Rev 3 later. Treat it as a watch item, not a to-do. Build to Rev 2 now; we'll flag it here the moment a final rule changes the answer.
What to do now
- Don't wait for the FAR CUI Rule. It's proposed and government-wide; it doesn't touch your current CMMC obligation. Your contract's clause does.
- Read the actual clause numbers on your solicitation. New awards use the renumbered clauses (252.240-7997, 52.240-93); older contracts keep the legacy numbers. See the clause map.
- Keep executing. Self-assess with the free SPRS calculator, draft your SSP, and track gaps on a POA&M. None of the 2026 changes alter that work.
The FAR CUI Rule & CMMC — FAQ
Does the FAR CUI Rule change my CMMC requirement?
No. It's a proposed, government-wide rule for identifying and safeguarding CUI. The Department of War's CMMC clauses — DFARS 252.204-7012 and 252.204-7021 — are unchanged. Level 2 (Self) still means self-assess against NIST 800-171 Rev 2, post to SPRS, and affirm.
Is the FAR CUI Rule in effect yet?
No — it's a proposed rule. First proposed Jan 15, 2025, reissued as an updated proposed rule on June 23, 2026 under the FAR Overhaul, with comments due July 23, 2026. Nothing in it is binding until a final rule takes effect, which the FAR Council expects before the end of 2026.
What does the FAR CUI Rule actually do?
It implements the NARA CUI Program across all federal agencies and adds a standard form (SF XXX) that tells contractors when CUI is involved, which categories, where it resides, and how to protect and report on it — mainly closing the gap for civilian agencies that lacked a uniform CUI framework.
Did the "Basic" self-assessment get eliminated?
No. The rewritten DFARS 252.240-7997 dropped the "Basic" self-assessment definition from that clause (it now covers only government-performed Medium/High assessments), but your CMMC Level 2 (Self) obligation lives in DFARS 252.204-7021 — unchanged and unsuspended.
Does the FAR CUI Rule move me to NIST 800-171 Rev 3?
Not today. The proposed FAR CUI clause references Rev 3 for its own requirement, but it isn't final and doesn't change CMMC. CMMC and SPRS still use Rev 2. It's the most likely long-term on-ramp to Rev 3 government-wide — a watch item, not a current obligation.
Cut through the noise with your own numbers
The rules around CUI are moving; the controls under them aren't. Calculate your SPRS score, draft your SSP, and build your POA&M — all free, all in your browser. For the related 2026 changes, see the FAR Overhaul clause renumbering and CMMC Phase 2 suspended.