Proposed Federal Rules Would Require Contractors to Report CUI Incidents Within 72 Hours
Summary
Proposed federal rules would require contractors handling controlled unclassified information to meet NIST cybersecurity standards and report unauthorized access within 72 hours. The rules could take effect before the end of the current administration.
Key points
- The proposed rules cover contractors handling controlled unclassified information, including sensitive personal and critical-infrastructure information.
- Contractors would have to report unauthorized access, including incidents resulting from cyberattacks, to the federal government within 72 hours of discovery.
- The draft requires minimum electronic security standards based on NIST SP 800-171 and could apply to a broader group of contractors than existing Defense Department rules.
- Contractors would need to pass applicable requirements to subcontractors and oversee their handling of CUI.
- Noncompliance could expose contractors to penalties under the False Claims Act.
- Earlier drafts proposed an eight-hour reporting window; industry groups have raised concerns about the 72-hour deadline and agency-specific reporting channels.
- The final timing and details remain uncertain; experts said contractors should begin preparing.
Article Details
- Event Type
- Proposed federal regulations for contractors handling controlled unclassified information (CUI), including cybersecurity standards and breach reporting requirements.
- Impact
- If finalized as written, contractors handling CUI would need to meet minimum electronic security standards, including NIST SP 800-171, report unauthorized access within 72 hours, and flow requirements down to subcontractors. Noncompliance could expose contractors to penalties under the False Claims Act. The rules remain proposed, and their timing and final form are uncertain.
People
Ryan BurnetteCovington partner focused on government contracts and technology who commented on the proposed CUI rules.Susan CassidyCovington partner who advises government contractors and commented on the proposed CUI rules.Trayce HowardGovernment contracts partner at Wiley Rein who commented on the proposed CUI rules.