4278 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 

DEPARTMENT OF DEFENSE 

GENERAL SERVICES 

ADMINISTRATION 

NATIONAL AERONAUTICS AND 

SPACE ADMINISTRATION 

48 CFR Parts 1, 2, 3, 4, 5, 7, 9, 11, 12, 

15, 27, 33, 42, 52, and 53 

[FAR Case 2017–016, Docket No. 2017– 

0016, Sequence No. 1] 

RIN 9000–AN56 

Federal Acquisition Regulation: 

Controlled Unclassified Information 

AGENCY: Department of Defense (DoD), 

General Services Administration (GSA), 

and National Aeronautics and Space 

Administration (NASA). 

ACTION: Proposed rule. 

SUMMARY: DoD, GSA, and NASA are 

proposing to amend the Federal 

Acquisition Regulation (FAR) to 

implement the National Archives and 

Records Administration’s Controlled 

Unclassified Information Program 

enacted under an Executive Order 

entitled Controlled Unclassified 

Information. 

DATES: Interested parties should submit 

written comments to the Regulatory 

Secretariat Division at the address 

shown below on or before March 17, 

2025 to be considered in the formation 

of the final rule. 

ADDRESSES: Submit comments in 

response to FAR Case 2017–016 to the 

Federal eRulemaking portal at https://

www.regulations.gov by searching for 

‘‘FAR Case 2017–016’’. Select the link 

‘‘Comment Now’’ that corresponds with 

‘‘FAR Case 2017–016’’. Follow the 

instructions provided on the ‘‘Comment 

Now’’ screen. Please include your name, 

company name (if any), and ‘‘FAR Case 

2017–016’’ on your attached document. 

If your comment cannot be submitted 

using https://www.regulations.gov, call 

or email the points of contact in the FOR

FURTHER INFORMATION CONTACT section of 

this document for alternate instructions. 

Instructions: Please submit comments 

only and cite ‘‘FAR Case 2017–016’’ in 

all correspondence related to this case. 

Public comments may be submitted as 

an individual, as an organization, or 

anonymously (see frequently asked 

questions at https://

www.regulations.gov/faq). Comments 

submitted in response to this rule will 

be made publicly available and are 

subject to disclosure under the Freedom 

of Information Act. For this reason, 

please do not include in your comments 

information of a confidential nature, 

such as sensitive personal information 

or proprietary information, or any 

information that you would not want 

publicly disclosed unless you follow the 

instructions below for confidential 

comments. Summary information of the 

public comments received, including 

any specific comments, will be posted 

on https://www.regulations.gov. 

All filers using the portal should use 

the name of the person or entity 

submitting comments as the name of 

their files, in accordance with the 

instructions below. Anyone submitting 

business confidential/proprietary 

information should clearly identify any 

business confidential/proprietary 

portion at the time of submission, file a 

statement justifying nondisclosure and 

referencing the specific legal authority 

claimed, and provide a nonconfidential/non-proprietary version of 

the submission. Any business 

confidential information should be in an 

uploaded file that has a file name 

beginning with the characters ‘‘BC.’’ 

Any page containing business 

confidential information must be clearly 

marked ‘‘BUSINESS CONFIDENTIAL/ 

PROPRIETARY’’ on the top of that page. 

The corresponding non-confidential/ 

non-proprietary version of those 

comments must be clearly marked 

‘‘PUBLIC.’’ The file name of the nonconfidential version should begin with 

the character ‘‘P.’’ The ‘‘BC’’ and ‘‘P’’ 

should be followed by the name of the 

person or entity submitting the 

comments or rebuttal comments. All 

filers should name their files using the 

name of the person or entity submitting 

the comments. Any submissions with 

file names that do not begin with a ‘‘BC’’ 

will be assumed to be public and will 

be made publicly available through 

https://www.regulations.gov. 

To confirm receipt of your 

comment(s), please check https://

www.regulations.gov, approximately 

two-to-three days after submission to 

verify posting. 

FOR FURTHER INFORMATION CONTACT: For 

clarification of content, contact Mr. 

Michael O. Jackson, Procurement 

Analyst, at 202–821–9776 or by email at 

michaelo.jackson@gsa.gov. For 

information pertaining to status, 

publication schedules, or alternate 

instructions for submitting comments if 

https://www.regulations.gov cannot be 

used, contact the Regulatory Secretariat 

Division at 202–501–4755 or 

GSARegSec@gsa.gov. Please cite FAR 

Case 2017–016. 

SUPPLEMENTARY INFORMATION: 

I. Background 

Today, Federal information and 

information systems are increasingly the 

targets of sophisticated attacks by 

criminals and our adversaries, as well as 

subject to risks involving nonadversarial threats (e.g., accidental 

misuse of information). Executive Order 

(E.O.) 13556, Controlled Unclassified 

Information, established the Controlled 

Unclassified Information (CUI) Program 

to manage information that requires 

safeguarding or dissemination controls 

and designated the National Archives 

and Records Administration (NARA) as 

the executive agent of the CUI Program. 

NARA published a final rule on 

September 14, 2016 (81 FR 63324) to 

implement the CUI requirements of E.O. 

13556. As part of the implementation of 

the NARA final rule, NARA maintains 

a registry (https://www.archives.gov/cui) 

of unclassified information that requires 

safeguarding or dissemination controls. 

NARA’s CUI Registry identifies the 

organizational index grouping and 

related categories of information and 

specifies how the information should be 

marked and disseminated, among other 

actions that must be taken. 

NARA’s rule codified uniform 

policies and procedures for marking, 

safeguarding, disseminating, 

decontrolling, and disposing of CUI for 

Federal executive branch agencies at 32 

CFR part 2002. These policies also affect 

contractors that are expected to collect, 

develop, receive, transmit, use, handle, 

or store CUI during contract 

performance. To apply the policies to 

contractors, the CUI Program must be 

incorporated into the acquisition 

process, specifically, when agencies 

define their requirements, issue 

solicitations, and award contracts. In 

order to do so, Government and 

contractor roles and responsibilities for 

safeguarding, using, marking, 

disseminating, and decontrolling CUI 

residing on both Federal and nonFederal information systems must be 

identified. 

DoD has implemented the 

requirements of the CUI Program within 

the clause at Defense Federal 

Acquisition Regulation Supplement 

(DFARS) 252.204–7012, Safeguarding 

Covered Defense Information and Cyber 

Incident Reporting. DoD has also 

proposed amending the DFARS to 

incorporate contractual requirements 

associated with the Cybersecurity 

Maturity Model Certification program 

(CMMC) in order to verify contractor 

implementation of security controls 

through a proposed rule published in 

the Federal Register on August 15, 

2024, at 89 FR 66327. Separately, the 

CMMC program was established in Title 

32 of the Code of Federal Regulations 

through a final rule published in the 


lotter on DSK11XQN23PROD with PROPOSALS4
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4279 

Federal Register on October 15, 2024, at 

89 FR 83092. 

DoD, GSA, and NASA are proposing 

to revise the FAR to implement NARA’s 

final rule on the Federal CUI Program as 

it relates to performance under Federal 

contracts. The Privacy Act requirements 

at FAR part 24 are not changed by this 

rulemaking. 

DoD, GSA, and NASA propose to 

create a common mechanism, the 

Standard Form XXX, Controlled 

Unclassified Information (CUI) 

Requirements, to enable a uniform 

process for communicating the 

information contractors must manage 

and safeguard as well as identify where 

a CUI incident must be reported and 

when there are CUI incident reporting 

requirements that differ from or are in 

addition to those in the clause at FAR 

52.204–XX(g). Currently laws, Federal 

regulations, and Government-wide 

policies already mandate these 

protections, but there is not a standard 

way these requirements are identified 

and shared with contractors. 

This proposed rule is just one element 

of a larger strategy to improve the 

Government’s efforts to identify, deter, 

protect against, detect, and respond to 

increasingly sophisticated criminals and 

adversaries targeting Federal 

information and information systems. 

II. Discussion and Analysis 

The proposed rule introduces a new 

standard form (SF) to support 

uniformity in Governmentwide 

implementation of these policies. It 

identifies roles and responsibilities for 

agencies and contractors when 

controlled unclassified information 

(CUI) is located on Federal information 

systems within a Federal facility or 

resides on or transits through contractor 

information systems or within 

contractor facilities, and it adds two 

new clauses and a provision to enable 

contractor reporting and compliance 

responsibilities in Federal solicitations 

and contracts. 

The proposed rule is intended to 

provide for the following: 

(1) SF XXX, Controlled Unclassified 

Information (CUI) Requirements, was 

developed to promote consistency, 

assist Federal agencies and contractors 

in the identification of CUI in agency 

requirements, and uniformly define all 

associated handling requirements in 

accordance with 32 CFR part 2002. The 

SF XXX will be included in solicitations 

and contracts that may result in the 

handling of CUI that will ultimately 

become performance requirements 

during contract performance. 

(2) FAR 2.101 definitions for 

‘‘contractor-attributional information,’’ 

‘‘controlled unclassified information 

(CUI),’’ ‘‘CUI incident,’’ and ‘‘CUI 

Registry’’ are added to provide 

clarification as these terms are new to 

the FAR. The definition of ‘‘information 

system’’ is moved from FAR subpart 

4.19 to 2.101. The term ‘‘Federallycontrolled information system’’ is 

updated to ‘‘Federal information 

system.’’ 

(3) FAR 3.104–4 is amended to clarify 

that certain information must be marked 

by the contractor before submitting it to 

the Government (contractor bid or 

proposal information, contractorattributional information, contractor 

proprietary business information, and 

source selection information). 

Contracting officers should consult with 

the contractor if they are unsure 

whether information provided by the 

contractor falls into one of these 

categories. Contracting officers who are 

unsure how to handle such information, 

including whether it is CUI, should 

consult with agency officials as 

necessary. 

(4) FAR subpart 4.4: 

• The subpart heading is revised to 

read ‘‘Safeguarding Information and 

Information Systems’’ since the 

information referred to in subpart 4.4 is 

not limited to classified information and 

now includes CUI. 

• Section 4.401 is amended to add a 

definition for ‘‘information’’ which was 

moved and revised from the definition 

currently at FAR 4.1901. 

• At FAR 4.403 and 4.404, the current 

content is moved to FAR 4.402. 

• FAR 4.403 is replaced with new 

content that provides instructions on 

the implementation of the CUI Program. 

The added language identifies the 

contracting officer’s role in receiving 

and incorporating the SF XXX in 

solicitations and contracts and the 

contracting officer’s responsibilities 

during contract administration. A new 

provision at FAR 52.204–WW, Notice of 

Controlled Unclassified Information 

Requirements, and new clauses at FAR 

52.204–XX, Controlled Unclassified 

Information, and 52.204–YY, Identifying 

and Reporting Information That Is 

Potentially Controlled Unclassified 

Information, are also prescribed. The 

changes for FAR 4.403 include the 

following: 

D Existing FAR 4.403 has been 

renumbered as FAR 4.402–2. 

D The clause at FAR 4.404 was moved 

to a new FAR 4.402–3. 

D FAR 4.403–1 adds definitions for 

‘‘CUI Basic,’’ ‘‘CUI categories,’’ ‘‘CUI 

Specified,’’ ‘‘handling,’’ ‘‘lawful 

Government purpose,’’ ‘‘limited 

dissemination control,’’ and ‘‘on behalf 

of an agency.’’ 

D FAR 4.403–2 provides information 

on E.O. 13556 including that the E.O. 

establishes NARA as the executive agent 

for the CUI Program. 

D FAR 4.403–3 gives the applicability 

of the SF XXX and the new FAR clauses 

52.204–XX and 52.204–YY. 

D FAR 4.403–4 outlines the CUI 

policy and requires that CUI involved in 

performance of a contract shall be 

identified on a SF XXX and 

incorporated into the contract. 

Unmarked or mismarked CUI is not 

considered a CUI incident unless the 

mismarking or lack of marking has 

resulted in the mishandling or improper 

dissemination of the information. 

Offerors are requested and contractors 

are required to notify the Government 

within an 8 hour timeframe if they 

discover or suspect information is CUI, 

but that CUI is not listed on an SF XXX 

or is not marked or properly marked. 

D FAR 4.403–5 adds the usage of the 

SF XXX. The SF XXX itself has detailed 

instructions. 

D FAR 4.403–6 provides that the 

agency point of contact to whom the 

contractor reports an incident is found 

in the SF XXX at Part C, Section IV. 

When the SF XXX is not used in a 

contract, the point of contact is 

identified in FAR 52.204–YY(b). FAR 

4.403–6 explains that the SF XXX 

should list any special incident 

reporting requirements for CUI 

Specified. FAR 4.403–6 also adds that 

the contracting officer shall provide 

instructions to the contractor for 

submitting the system images, in 

accordance with agency procedures. 

FAR 4.403–6 also explains that the 

contractor is required to hold the system 

images for 90 days unless the 

Government declines interest. 

D FAR 4.403–7 requires the 

contracting officer to insert the clause at 

FAR 52.204–XX, Controlled 

Unclassified Information, or the clause 

at FAR 52.204–YY, Identifying and 

Reporting Information That Is 

Potentially Controlled Unclassified 

Information, and to insert the provision 

at FAR 52.204–WW, Notice of 

Controlled Unclassified Information 

Requirements, in solicitations and 

contracts, excluding solicitations and 

contracts solely for the acquisition of 

commercially available off-the-shelf 

(COTS) items. 

• FAR 4.404 clause prescription is 

moved to FAR 4.403–7. Coverage from 

FAR subpart 4.19 has been moved to 

FAR 4.404. 

• Several organizational changes, 

including relocation of text and 

definitions from FAR subpart 4.19, 

improve the logical flow of information. 


lotter on DSK11XQN23PROD with PROPOSALS4
4280 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 

• FAR 4.404–1 adds definitions for 

‘‘covered contractor information 

system’’ and ‘‘covered Federal 

information.’’ The term ‘‘Federal 

contract information’’ was changed to 

‘‘covered Federal information’’ to align 

with the term ‘‘covered contractor 

information system,’’ and the definition 

of ‘‘covered Federal information’’ was 

revised to clarify that the term excludes 

CUI and classified information. The 

definition of ‘‘covered Federal 

information’’ is also amended in FAR 

clause 52.204–21, Basic Safeguarding of 

Covered Contractor Information 

Systems. 

• FAR 4.404–2, Applicability, has 

been added to state that while covered 

Federal information is not required to be 

marked or identified by the 

Government, some administrative 

markings (e.g., draft, deliberative 

process, predecisional, not for public 

release) can indicate that the 

information is covered Federal 

information. 

• FAR 4.404–3 has been added to 

require the contracting officer to insert 

the clause at FAR 52.204–21, Basic 

Safeguarding of Covered Contractor 

Information Systems, in solicitations 

and contracts, excluding solicitations 

and contracts solely for the acquisition 

of COTS items or Federally-funded 

basic and applied research in science, 

technology, and engineering at colleges, 

universities, and laboratories in 

accordance with National Security 

Decision Directive 189 when the agency 

does not provide any covered Federal 

information to the contractor. FAR 

4.404–3 replaces the clause prescription 

section at FAR 4.1903. The prescription 

for the clause at FAR 52.204–21 was 

updated to match the prescription for 

the CUI clause, because, while both 

types of information are likely to be in 

a wide range of contracts, covered 

Federal information is more ubiquitous 

than CUI and it may be difficult for the 

contracting officer to identify during 

development of the solicitation when 

covered Federal information may be 

applicable for the procurement. 

• FAR 4.1301 and 4.1303 have been 

updated to remove the references to 

‘‘PUB Number’’ and ‘‘PUB’’ and edit the 

term ‘‘Federally-controlled information 

system’’ to make it ‘‘Federal information 

system’’. 

(5) FAR 7.103, Agency-head 

responsibilities. New language is added 

to describe agency planners’ 

responsibilities for compliance with 32 

CFR part 2002 and the completion of the 

SF XXX during acquisition planning. 

(6) FAR 7.105, Contents of written 

acquisition plans. CUI is added to the 

security considerations to be addressed 

during acquisition planning. 

(7) At FAR 7.503, Policy, language has 

been revised to clarify that the list of 

examples of functions generally not 

considered to be inherently 

governmental functions, includes 

contractors working in any situation 

that permits or might permit them to 

gain access to CUI. 

(8) FAR subpart 9.5, Organizational 

and Consultant Conflicts of Interest, 

includes updates to FAR 9.505, 9.505– 

4, and 9.508 to make clear proprietary 

information is contractor proprietary 

business information. 

(9) FAR 11.002, Policy. New language 

is added to incorporate the requirements 

for CUI and use of the SF XXX when 

describing agency needs. 

(10) FAR 12.202, Market research and 

description of agency need. New 

language is added to incorporate the 

requirements for CUI and the SF XXX in 

requirements documents for the 

acquisition of commercial products and 

commercial services. 

(11) At FAR 15.407–1, a reference to 

CUI and classified information is added 

to clarify the type of information that 

should be protected from improper 

disclosure. 

(12) At FAR subpart 15.6, conforming 

changes are made to change 

‘‘proprietary information’’ and 

‘‘restrictive legend’’ or ‘‘legend’’ to 

‘‘contractor proprietary business 

information’’ and ‘‘administrative 

marking,’’ respectively. 

(13) FAR 27.203, Security 

requirements for patent applications 

and other patent information. A new 

section is added to inform contracting 

officers that CUI safeguarding 

requirements apply to patent 

application and other patent 

information. 

(14) FAR part 52. A new provision 

FAR 52.204–WW, Notice of Controlled 

Unclassified Information Requirements, 

is added to inform offerors of 

requirements on restricted use of 

Government-provided information, on 

appropriately identifying sensitive 

offeror-provided information, and on 

notifying the Government regarding 

unmarked or mismarked CUI. A new 

FAR clause 52.204–XX, Controlled 

Unclassified Information, is added to 

require contractors to comply with 

applicable CUI requirements, if the SF 

XXX indicates that the contractor is 

expected to collect, develop, receive, 

transmit, use, handle, or store CUI 

under the contract. A new FAR clause 

52.204–YY, Identifying and Reporting 

Information That Is Potentially 

Controlled Unclassified Information, is 

added to apply to contracts in which the 

requiring activity indicates on the SF 

XXX that no CUI is involved in the 

performance of the contract. CUI 

requirements include: 

• Requirements for how the 

contractor must mark CUI submitted to 

the Government and notify the 

Government of any mismarked or 

unmarked CUI discovered; 

• Restrictions on the contractor’s use 

of Government-provided information 

apply whether or not the information is 

marked as CUI; 

• Requirements for safeguarding CUI 

residing on Federal and non-Federal 

systems, as identified in the SF XXX, 

Controlled Unclassified Information 

(CUI) Requirements; 

• Requirements for reporting and 

managing security incidents; 

• Actions that may be necessary to 

validate compliance; 

• Minimum CUI training 

requirements; and 

• The requirement for contractors to 

flow down CUI requirements to 

subcontractors, if applicable. 

(15) FAR 52.204–21, Basic 

Safeguarding of Covered Contractor 

Information Systems. Text is added for 

the definition and at paragraph (b)(3) for 

the identification of ‘‘covered Federal 

information’’. 

(16) FAR clause 52.212–5 is updated 

to reflect that FAR clause 52.204–XX is 

applicable to acquisitions of commercial 

products and services. FAR clause 

52.213–4 is updated to reflect usage of 

the FAR 52.204–XX clause in simplified 

acquisitions for other than commercial 

products or services. FAR clause 

52.244–6 is updated to address the flow 

down to subcontracts for the two new 

clauses. 

(17) Additional minor edits are made 

at FAR 1.106 to add the OMB control 

number information for the provision 

and clause, at FAR 42.302 to update a 

cross-reference, and at FAR subpart 53.2 

to add the new SF XXX, Controlled 

Unclassified Information (CUI) 

Requirements. 

III. Applicability to Contracts at or 

Below the Simplified Acquisition 

Threshold (SAT) and for Commercial 

Products, Including Commercially 

Available Off-the-Shelf (COTS) Items, 

or Commercial Services 

This rule proposes a new provision at 

FAR 52.204–WW, Notice of Controlled 

Unclassified Information Requirements. 

The proposed provision is prescribed at 

FAR 4.403–7(a) for use in solicitations 

that contain the clause at FAR 52.204– 

XX or the clause at FAR 52.204–YY. The 

rule proposes a new clause at FAR 

52.204–XX, Controlled Unclassified 

Information. The proposed clause is 


lotter on DSK11XQN23PROD with PROPOSALS4
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4281 

prescribed at FAR 4.403–7(b) for use in 

solicitations and contracts if the 

requiring activity has marked the ‘‘Yes’’ 

box in Part A of the SF XXX, except for 

solicitations and contracts solely for the 

acquisition of COTS items. The rule 

proposes a new clause at FAR 52.204– 

YY, Identifying and Reporting 

Information That Is Potentially 

Controlled Unclassified Information. 

The proposed clause is prescribed at 

FAR 4.403–7(c) for use in solicitations 

and contracts if the requiring activity 

has marked the ‘‘No’’ box in Part A of 

the SF XXX, excluding solicitations and 

contracts solely for the acquisition of 

COTS items. 

This rule also proposes to amend the 

FAR to implement 32 CFR part 2002, 

Controlled Unclassified Information, in 

Federal solicitations and contracts. The 

objective of the rule is to implement 

uniform, Governmentwide policies and 

procedures for Federal agencies and 

contractors regarding handling of CUI. 

Since CUI requires protection regardless 

of dollar value or commerciality of the 

product or service, this rule will apply 

to contracts at or below the SAT and to 

commercial products and commercial 

services. The rule does not apply to 

contracts that are solely for the 

acquisition of COTS items. 

IV. Expected Impact of the Rule 

A. General Compliance Requirements 

Under the terms of this proposed rule, 

contractors will be required to safeguard 

CUI that the Government identifies in 

the standard form (SF) XXX, Controlled 

Unclassified Information (CUI) 

Requirements, and ensure handling 

consistent with 32 CFR part 2002. This 

includes CUI that the agency provides to 

the contractor, or CUI that the contractor 

collects, develops, receives, transmits, 

uses, handles, or stores in performance 

of the contract. CUI is defined at FAR 

2.101 as information that the 

Government creates or possesses, or that 

an entity creates or possesses for or on 

behalf of the Government, that a law, 

regulation, or Governmentwide policy 

requires or permits an agency to handle 

using safeguarding or dissemination 

controls. 

The contractor shall permit access to 

CUI only as described in the SF XXX. 

A contractor will need to review the SF 

XXX to determine what information 

under the contract is considered CUI 

and how to properly safeguard the CUI. 

If the contractor intends to flow CUI 

down to a subcontractor, then the 

contractor will also be required to 

prepare an SF XXX and distribute it to 

the subcontractor to ensure the 

subcontractor properly safeguards CUI. 

Any contractor or subcontractor 

employee that handles CUI will be 

required to complete training on 

safeguarding CUI, as specified on the SF 

XXX. 

Identification of CUI on the SF XXX 

triggers compliance requirements as 

specified in the new contract clause at 

FAR 52.204–XX, Controlled 

Unclassified Information, e.g., security 

requirements in NIST SP 800–171, 

Revision 2, or controls in NIST SP 800– 

53 depending on the type of information 

systems that process, store, or transmit 

CUI. The compliance requirements are 

discussed in more detail in section IV.C. 

of this preamble and will vary 

depending on the organizational Index 

Grouping and category of CUI being 

handled under the contract and how the 

information is being collected, 

developed, received, transmitted, used, 

handled, or stored. Prime contractors 

that flow down CUI to subcontractors 

will also be required to flow down the 

compliance requirements of the clause 

at FAR 52.204–XX; a requirement that 

applies at all subcontract tiers. The new 

clause at FAR 52.204–YY also flows 

down to subcontracts. 

A new solicitation provision at FAR 

52.204–WW, Notice of Controlled 

Unclassified Information Requirements, 

is prescribed for use in solicitations that 

contain the new clause at FAR 52.204– 

XX or the new clause at FAR 52.204– 

YY. This provision provides a notice to 

offerors that agencies will provide 

agency procedures on handling CUI 

during the solicitation phase if handling 

CUI is necessary to prepare an offer. The 

notice also advises offerors that 

contractor bid or proposal information, 

proprietary business information, or 

contractor-attributional information 

must be properly marked to ensure 

adequate protection of their 

information. The provision also advises 

offerors that they should notify the 

contracting officer if there appears to be 

unmarked or mismarked CUI or an 

incident related to CUI handled by the 

offeror during the solicitation phase. 

When the contract does not identify 

CUI, the new contract clause at FAR 

52.204–YY, Identifying and Reporting 

Information That Is Potentially 

Controlled Unclassified Information, is 

used in lieu of the CUI clause. Similar 

to the solicitation provision, this clause 

requires the contractor to notify the 

Government if there appears to be 

unmarked or mismarked CUI or a 

suspected CUI incident related to 

information handled by the contractor 

in performance of the contract. This 

clause requires the contractor to 

properly mark proprietary business 

information or contractor-attributional 

information to ensure adequate 

protection. 

The new solicitation provision and 

the new contract clauses all forbid an 

offeror or contractor from using 

Government-provided information for 

its own purposes, whether or not the 

information is marked as CUI, unless 

the information is in the public domain, 

or unless the information is lawfully 

made available to the offeror or 

contractor by someone other than the 

Government. 

B. Benefits 

1. Uniform Cybersecurity Hygiene 

Baseline 

Establishing uniform requirements for 

how the acquisition workforce and 

Federal contractors manage CUI will 

significantly improve the Government 

and Federal contractors’ ability to 

protect Federal information and 

information systems from criminals and 

our adversaries. Absent the uniform 

approach proposed in this rule, agencies 

will continue to employ ad hoc, agencyspecific policies to manage this 

information, an approach that can cause 

agencies to mark and handle 

information inconsistently and 

inefficiently. While waivers may be 

applied in some circumstances, this rule 

is intended to establish a 

Governmentwide baseline that will lead 

to more effective implementation of 

protections for this sensitive 

information by the acquisition 

workforce and contractors. More 

effective implementation of 

requirements for identifying and 

marking CUI will reduce scenarios in 

which contractors may not realize the 

information that they are handling is 

sensitive information that must be 

safeguarded. 

2. Protection From Potential Financial 

Impacts of CUI Incidents 

Failure to adopt these basic 

cybersecurity requirements can have a 

substantial financial impact on a 

business. There have been many 

analyses regarding the cost of 

cybersecurity incidents and the 

estimates vary widely. In order to 

establish a defensible set of cost and 

loss data that is suitable for the analysis 

of cybersecurity incident costs in the 

Federal sector, the Cyber Security and 

Infrastructure Security Agency (CISA) 

Office of the Chief Economist (OCE), in 

the Department of Homeland Security, 

reviewed a broad range of cyber cost 

and loss studies and presented an 

analysis of the per-incident, aggregate, 

and scenario-based estimates of cyber 

loss. On October 26, 2020, the CISA 


lotter on DSK11XQN23PROD with PROPOSALS4
4282 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 

1CISA OCE. (2020). Cost of a Cyber Incident: 

Systematic Review and Cross-Validation. https://

www.cisa.gov/sites/default/files/publications/CISA- OCE_Cost_of_Cyber_Incidents_Study-FINAL_

508.pdf. 

OCE released a report with the results 

of their analyses and a summary of perincident loss estimates available in the 

most widely cited published research, 

commercial datasets, and industry 

reports. OCE estimated the median cost 

of a cybersecurity incident cited in the 

surveyed publications ranged from $0.5 

to $1.6 million. The maximum cost per 

incident cited ranged from $11.7 million 

to greater than $1 billion. The CISA OCE 

acknowledges in its report that the 

differences in the assumptions, 

approaches to data collection, and 

specific incidents included in the 

datasets for the above sources result in 

a high degree of variability among the 

loss estimates.1

3. Increased Protection of Sensitive 

Information 

Given the potential financial impacts 

a CUI incident may have on companies 

and individuals, it is imperative that 

Federal contractors who are entrusted 

with sensitive information in the 

performance of Government contracts 

adopt the basic cybersecurity hygiene 

requirements outlined in this rule. This 

increased baseline of cybersecurity 

hygiene across Federal contractors will 

reduce the number of incidents that 

have the potential to place sensitive 

information at risk and pose serious 

threats to individuals, Federal 

operations and assets, and the 

contractors themselves. For the 

remaining incidents that may occur, the 

requirement for contractors to report 

suspected or confirmed CUI incidents 

within 8 hours, unless a different time 

period is required for a specific category 

of CUI or a Federally-controlled facility, 

will allow the Federal Government to 

have appropriate situational awareness, 

quickly respond to the incident, and 

reduce the impact of the event. 

C. Public Costs 

The total estimated public costs 

associated with this FAR rule in billions 

over a 10-year period are as follows: 

Public cost Undiscounted 2 Percent 

Present Value .......................................................................................................................................................... $17.63 $15.89 

Annualized ............................................................................................................................................................... 1.76 1.77 

Undiscounted public costs (in 

billions) by year over the 10-year period 

are summarized as follows: 

Year 1 Year 2 Year 3 Year 4 Year 5 Year 6 Year 7 Year 8 Year 9 Year 10 

$2.28 ............................................ $1.71 $1.71 $1.71 $1.71 $1.71 $1.71 $1.71 $1.71 $1.71 

The following is a summary from the 

Regulatory Impact Analysis (RIA) of the 

specific compliance requirements and 

the estimated costs of compliance. The 

new FAR clause is modeled after the 

most recent version of the clause at 

DFARS 252.204–7012, which 

introduced many of these compliance 

requirements on defense contractors and 

subcontractors in 2015 and required 

compliance not later than December 31, 

2017. Therefore, the estimated costs of 

compliance have been segregated into 

those that are new for Federal offerors, 

contractors, and subcontractors (see 

section IV.C.1 of this preamble) and 

those that are new only for non-defense 

contractors and subcontractors (see 

section IV.C.2 of this preamble). The 

RIA includes a detailed discussion and 

explanation about the assumptions and 

methodology used to estimate the cost 

of this regulatory action, including the 

specific impact and costs for small 

businesses. Public comment is 

requested on the RIA, which is available 

at https://www.regulations.gov (search 

for ‘‘FAR Case 2017–016,’’ click ‘‘Open 

Docket,’’ and view ‘‘Supporting 

Documents’’). 

1. Federal Offerors, Contractors, and 

Subcontractors 

The following compliance 

requirements are considered new for 

Federal offerors, contractors, and 

subcontractors required to safeguard 

CUI: 

a. Regulatory Familiarization 

Familiarization accounts for the time 

to read and understand the rule. It is 

expected that most contractors will be 

required to become familiar with the 

various compliance requirements of the 

FAR, in order to be prepared to handle 

or receive CUI in performance of a 

Federal contract. According to award 

data in the Federal Procurement Data 

System (FPDS) for fiscal year (FY) 2021 

through FY 2023, on average per year 

the Government awards contracts and 

orders for supplies and services to 

67,547 unique contractors, all of whom 

are expected to become familiar with 

this rule. It is estimated that on average 

it will take two hours per contractor and 

subcontractor that handle CUI to review 

the rule. The estimated cost for 

regulatory familiarization in the first 

year of implementation is $10,267,144 

(67,547 contractors and subcontractors * 

2 hours/entity * $76/hour), of which 

$6,711,104 is attributed to 44,152 small 

businesses. 

b. Review the SF XXX 

Offerors, contractors, or 

subcontractors will need to review the 

SF XXX to determine the information 

under the contract or subcontract that is 

considered CUI and how to properly 

safeguard the CUI. It is estimated that 

approximately 22,680 offerors, 

contractors, and subcontractors may 

review 2,092,918 forms for information 

on how to protect CUI each year. On 

average, it is estimated that it will take 

an offeror, contractor, or subcontractor 

two hours to review the SF XXX. The 

estimated annual cost to review 

standard forms is $334,866,880 

(2,092,918 forms * 2 hours/form * $80), 

of which $5,058,880 is attributed to 

15,809 small businesses. 

c. Prepare and Distribute the SF XXX 

If the contractor intends to flow down 

CUI to a subcontractor, then the 

contractor must prepare an SF XXX and 

distribute it to the subcontractor to 

ensure the subcontractor properly 

safeguards CUI. It is estimated 517,392 

standard forms may be prepared and 

distributed by contractors and 


lotter on DSK11XQN23PROD with PROPOSALS4
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4283 

subcontractors each year. On average, it 

is estimated that it will take the 

contractor or subcontractor two hours to 

prepare and distribute the SF XXX. The 

estimated annual cost to prepare and 

distribute the SF XXX is $82,782,270 

(517,392 forms * 2 hours/form * $80), of 

which $2,529,440 is attributed to 15,809 

small business contractors and 

subcontractors. 

d. Train Employees on Handling CUI 

A contractor shall not permit any 

contractor employee to collect, develop, 

receive, transmit, use, handle, or store 

CUI unless the employee has completed 

training on properly handling CUI as 

described in the SF XXX. The contractor 

must provide evidence of employee 

training upon request by the contracting 

officer; however, such requests are 

expected to be limited to, for example, 

instances in which the Government is 

dealing with a CUI incident. It is 

estimated that approximately 2,191,400 

contractor and subcontractor employees 

may be required to take training on 

handling CUI, which is expected to take 

one hour to complete. It is anticipated 

that agencies will provide their support 

contractors and personnel with CUI 

standard training aligned with Federal 

policy. 

The estimated annual training cost is 

$166,546,400 (2,191,400 employees * 1 

hour/employee * $76/hour), of which 

$26,440,400 is attributed to 34,790 small 

business contractors and subcontractors. 

The estimated annual recordkeeping 

cost to maintain contractor training 

records is $10,003,741 (2,191,400 

records * 0.083 hours/record * $55/ 

hour), of which $1,588,164 is attributed 

to the 34,790 small businesses. The 

estimated annual reporting cost is 

$19,664 (1,430 requests * 0.25 hours/ 

response * $55/hour), of which $13,401 

is attributed to 975 small businesses. 

e. Comply With NIST SP 800–172 

A limited number of contractors may 

be required to implement NIST SP 800– 

172, Enhanced Security Requirements 

for Protecting Controlled Unclassified 

Information: A Supplement to NIST 

Special Publication 800–171, for 

components of non-Federal systems that 

process, store, or transmit CUI or that 

provide security protection for such 

components when the designated CUI is 

associated with a critical program or 

high-value assets. Contractors that are 

subject to these enhanced security 

requirements may incur additional 

process/information technology 

configuration, network isolation, and 

security operations center/threat-related 

costs; however, the impact on any 

particular contractor may vary 

considerably, depending on a 

contractor’s current infrastructure and 

development environment, and the 

composition of their customer base. 

It is estimated that approximately 160 

contractors may be subject to the 

enhanced security requirements. Of 

these 160 contractors, 100 are 

categorized as small businesses with 

25–50 end-point systems. The estimated 

cost of initial implementation of NIST 

SP 800–172 for each of these contractors 

is $202,500. Twenty contractors are 

estimated to have 50–100 end-point 

systems (medium businesses) and 40 are 

expected to have 750–1500 end-point 

systems (large businesses). The 

estimated costs of initial 

implementation for these contractors are 

approximately $1,000,000 per medium 

business and $2,315,000 per large 

business. 

Therefore, the total estimated cost for 

160 contractors to implement NIST SP 

800–172 is $132,850,000, of which 

$20,250,000 is attributed to 100 small 

businesses. Annual recurring costs are 

estimated to be 20 percent of the cost of 

initial implementation. 

f. Submit Supporting Documentation To 

Verify Compliance 

A contractor may also be required to 

submit to the Government a description 

of the system security plan required by 

NIST SP 800–171 Revision 2 to 

demonstrate their implementation of the 

security requirements in NIST SP 800– 

171 Revision 2. Requests for access to 

review the system security plan are 

expected to be rare, such as in response 

to a reported CUI incident. It is 

estimated that the system security plan 

may be requested 1,430 times and that 

it would take a contractor 30 minutes to 

submit the plan. The total estimated 

annual cost is $67,925 (1 request * 1,430 

contractors * 0.5 hours/response * $95/ 

hour), of which $46,294 is attributed to 

975 small businesses. 

Note, the cost to develop and 

maintain a system security plan in 

accordance with NIST SP 800–171 

Revision 2 is attributed only to nondefense contractors (see sections 

IV.C.2.a. and IV.C.2.d. of this preamble) 

since defense contractors are subject to 

NIST SP 800–171 Revision 2 pursuant 

to DFARS clause 252.204–7012 and 

should already maintain system security 

plans. 

g. Comply With Additional Security 

Requirements Identified in the 

Solicitation or Requirements Document 

In addition to the security 

requirements outlined in the SF XXX 

and the new FAR clause at 52.204–XX, 

the requirements document may require 

the contractor to comply with controls 

beyond NIST SP 800–171 Revision 2 to 

address unique requirements to protect 

CUI Basic at higher than the moderate 

confidentiality level in accordance with 

32 CFR 2002.14(h)(2). Similarly, if 

offerors require access to CUI, the 

Government will provide agency 

procedures on handling the CUI to 

ensure compliance with the 

requirements in 32 CFR 2002. The 

contractor shall also implement 

additional information security 

requirements it reasonably determines 

necessary to provide adequate security 

in a dynamic environment. Given that 

agencies have discretion in developing 

their contract-specific requirements, the 

Government does not attempt to 

quantify these costs. 

h. Comply With Additional Notification 

and Marking Requirements 

Offerors and contractors are required 

to notify the contracting officer 

representative or other designated 

agency official concerning any 

unmarked or mismarked CUI if 

discovered. These potential costs are not 

quantified since such occurrences are 

expected to be rare. In addition, to the 

maximum extent practicable, the offeror 

or contractor shall identify and mark its 

proprietary business and attributional 

information. These costs are also not 

quantified since an offeror or contractor 

usually marks its proprietary 

information as a best business practice 

to protect its own interests and 

information. Finally, offerors are 

required to notify the contracting officer 

of a potential CUI incident within 8 

hours of discovery. Such occurrences 

are expected to be rare and are assumed 

to be accounted for under the public 

cost estimate for CUI incident reporting 

in section IV.C.2.b. of this preamble. 

2. Non-Defense Contractors and 

Subcontractors 

a. Comply With NIST SP 800–171 

Revision 2 

A contractor may need to depend on 

the expertise of information security 

specialists to develop and document 

processes and procedures associated 

with each security requirement, perform 

the periodic scans, tests, and 

assessments necessary for some of the 

security requirements, and analyze the 

results. The amount of time necessary to 

perform the various tasks will vary by 

contractor depending on the number of 

employees and the complexity of its 

information systems. Some contractors 

may already have personnel performing 

some of the functions as a matter of 

good business practice to protect their 


lotter on DSK11XQN23PROD with PROPOSALS4
4284 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 

networks, while others may be starting 

with no in-house expertise. 

The total estimated labor cost for a 

small business in the initial year is 

approximately $148,200 (average of 

1,560 hours * $95), with a recurring 

annual labor cost of approximately 

$98,800 (1,040 hours * $95). The total 

estimated labor cost for a business other 

than a small business in the initial year 

is approximately $543,400 (average of 

5,720 hours * $95), with a recurring 

annual labor cost of approximately 

$494,000 (5,200 hours * $95). Note, this 

does not include the time expected to 

maintain the system security plan (see 

section IV.C.2.d. of this preamble). 

Businesses may also need to install 

software and/or hardware to implement 

NIST SP 800–171 Revision 2. Similar to 

the labor costs, the cost of the specific 

software or hardware varies based on 

the solution selected by the business, a 

decision that will take into 

consideration the number of users, the 

types of devices used, and the 

complexity of the network, among other 

things. The Government estimates that a 

small business, on average, may spend 

$27,500 on hardware and software 

during initial implementation and 

$5,000 annually thereafter to maintain 

compliance. On average, a business 

other than a small business may spend 

$140,000 on hardware and software in 

the initial year and $80,000 annually 

thereafter. 

Therefore, the total estimated cost of 

labor, hardware, and software for 5,875 

contractors to implement NIST SP 800– 

171 Revision 2 in the initial year is 

$1,524,706,500, of which $861,808,500 

is attributed to 4,905 small businesses. 

The total estimated annual recurring 

maintenance costs are $1,065,919,000, 

of which $509,139,000 is attributed to 

4,905 small businesses. 

b. Assess and Report Suspected CUI 

Incidents 

When the contractor discovers a 

suspected CUI incident, the contractor 

is required by the clause at FAR 52.204– 

XX and, when applicable, the clause at 

FAR 52.204–YY to: determine what CUI 

was or could have been improperly 

accessed, used, processed, stored, 

maintained, disseminated, disclosed, or 

disposed of; construct a timeline of user 

activity; and determine methods and 

techniques used to access CUI. The 

contractor shall report any suspected or 

confirmed CUI incident to the agency 

website or point of contact identified in 

the SF XXX, within 8 hours of 

discovery. The clause at FAR 52.204– 

XX also requires the contractor to 

include in the report as many of the 

applicable data elements located on the 

DIBNet website (https://dibnet.dod.mil) 

as are available and provide any 

remaining applicable data elements as 

soon as they become available. 

Subcontractors are required by FAR 

52.204–XX(h) to notify the prime or 

next higher tier subcontractor within the 

same timeframe. When applicable, the 

clause at FAR 52.204–YY requires 

contractors to follow agency 

requirements related to the incident if it 

turns out CUI is involved. 

It is estimated that there may be 580 

incident reports submitted each year 

and that it may take a contractor four 

hours to prepare and submit CUI 

incident reports to civilian agencies. 

The total estimated annual cost for CUI 

incident reporting for non-defense 

contractors is $275,500 (580 nondefense contractors * 1 incident/nondefense contractor * 4 hours/response * 

$95/hour), of which $188,482 is 

attributed to 397 small businesses. 

c. Preserve and Protect Images for 

Suspected CUI Incidents and Submit 

Media and Data for Damage 

Assessments 

If a suspected or confirmed CUI 

incident has occurred on an information 

system, the contractor is required by the 

clause at FAR 52.204–XX to preserve 

and protect images of all known affected 

information systems and all relevant 

monitoring and packet capture data for 

at least 90 days from the submission of 

the report to allow the Government to 

request the media and data or decline 

interest during this 90 day period, after 

which, if no request has been made, the 

images need no longer be preserved. 

It is estimated that it will take a 

contractor approximately 7.5 hours to 

preserve and protect images of all 

known affected information systems and 

all relevant monitoring and packet 

capture data, assuming 30 minutes to 

image, 2 hours to preserve monitoring 

and packet capture data, and 5 hours to 

upload images and set up storage space. 

The estimated annual cost to preserve 

and protect images associated with 580 

CUI incidents is $413,250 (580 

contractors * 1 recordkeeper/contractor 

* 7.5 hours/record * $95/hour), of 

which $282,722 is attributed to 397 

small businesses. The estimated annual 

cost to submit media and data is 

$11,400 (48 non-defense contractors * 1 

incident/non-defense contractor * 2.5 

hours/response * 95/hour), of which 

$7,799 is attributed to 33 small 

businesses. 

d. Maintain the System Security Plan 

It is assumed that each of 10,242 nondefense contractors required to 

implement NIST SP 800–171 Revision 2 

has one information security analyst 

who spends one hour per month (or 12 

hours per year) maintaining the system 

security plan. The estimated annual 

recordkeeping cost is $11,675,880 

(10,242 contractors * 1 record/ 

recordkeeper * 12 hours/record * $95/ 

hour), of which $7,987,980 is attributed 

to 7,007 small businesses. 

e. Cooperate With Validation Actions 

for Non-Federal Information Systems 

The contractor shall cooperate with 

validation actions conducted by an 

agency in accordance with NIST SP 

800–171A, Assessing Security 

Requirements for Controlled 

Unclassified Information, and if 

applicable, NIST SP 800–172A for the 

enhanced security requirements. These 

types of validation actions are similar to 

the High Confidence Level Assessments 

being conducted by DoD pursuant to 

DFARS clause 252.204–7020, NIST SP 

800–171 DoD Assessment 

Requirements, whereby the Government 

reviews the system security plan 

description of how each security 

requirement is met and the contractor 

demonstrates its implementation. While 

cooperating with validation actions, a 

contractor may need to provide the 

Government access to its facilities, 

systems, and personnel. 

According to DoD, the total estimated 

cost for a contractor to participate in a 

strategic High Confidence Level 

Assessment is approximately $50,675 

per contractor. Therefore, the total 

annual estimated cost for the 110 nondefense contractors to cooperate with 

Government validation of a system 

security plan is $5,574,250, of which 

$4,104,675 is attributed to 81 small 

businesses. 

f. Comply With NIST SP 800–53 and the 

FedRAMP Moderate Baseline Standards 

The costs associated with contractor 

compliance with NIST SP 800–53 and 

the FedRAMP Moderate baseline 

standard for cloud service providers are 

excluded from this analysis of public 

cost, as they are being addressed under 

the proposed rule implementing section 

2.i. of Executive Order 14028, 

Improving the Nation’s Cyber Security 

(reference FAR Case 2021–019, 

Standardizing Cybersecurity 

Requirements for Unclassified Federal 

Information Systems). 

D. Government Costs 

The total estimated Government costs 

associated with this FAR rule in billions 

over a ten-year period are as follows: 


lotter on DSK11XQN23PROD with PROPOSALS4
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4285 

Government cost Undiscounted 2 Percent 

Present Value .......................................................................................................................................................... $4.69 $4.21 

Annualized ............................................................................................................................................................... 0.47 0.47 

Undiscounted Government costs (in 

billions) by year over the ten-year 

period are summarized as follows: 

Year 1 Year 2 Year 3 Year 4 Year 5 Year 6 Year 7 Year 8 Year 9 Year 10 

0.47 .............................................. $0.47 $0.47 $0.47 $0.47 $0.47 $0.47 $0.47 $0.47 $0.47 

The following is a summary from the 

RIA of the Government costs associated 

with reviewing contractor training 

records, investigating reports of 

suspected or confirmed CUI incidents, 

and other action associated with this 

FAR rule. 

1. Prepare the SF XXX 

While an SF XXX is required to be 

included in every solicitation and 

contract that involves CUI, except those 

exclusively for COTS items, the 

Government only incurs a significant 

cost when the CUI is identified on the 

form. The contracting officer is 

responsible for ensuring that the SF 

XXX identifies the protected 

information involved in the system of 

records and includes any safeguarding 

and marking requirements applicable to 

the information in accordance with FAR 

4.403. Of the 2,092,918 forms expected 

to specify requirements for safeguarding 

CUI (see section IV.C.1.b. of this 

preamble), 1,573,582 are expected to be 

prepared by the Government (see 

section IV.C.1.c. of this preamble for the 

estimate of forms prepared by 

contractors and subcontractors). The 

total estimated annual Government cost 

is $453,191,616 (1,573,582 forms * 4 

hour/form * $72/hour). 

2. Review Training Records 

It is estimated that it will take a 

Government employee 30 minutes to 

review evidence of training submitted 

by the contractors (see section IV.C.1.d. 

of this preamble). Therefore, the 

estimated annual reporting cost is 

$51,480 (1,430 requests * 0.5 hours/ 

response * $72/hour). 

3. Review CUI Incident Reports 

It is estimated that it will take a 

Government employee four hours to 

review the CUI incident information 

reported by a contractor (see section 

IV.C.2.b. of this preamble). The 

estimated annual cost to the 

Government is $292,900 (580 reports * 

5 hours/response * $101/hour). 

4. Review Media and Data for Damage 

Assessment 

It is estimated that it will take a 

Government employee 10 hours to 

conduct a damage assessment of media 

and data submitted by a contractor (see 

section IV.C.2.c. of this preamble). The 

estimated annual cost to the 

Government is $48,480 (48 submissions 

* 10 hours/response * $101/hour). 

5. Review System Security Plan 

It is estimated that it will take a 

Government employee four hours to 

review a system security plan submitted 

by a contractor (see section IV.C.1.g. of 

this preamble). The estimated annual 

cost to the Government is $577,720 

(1,430 reports * 4 hours/response * 

$101/hour). 

6. Conduct Validation Actions for NonFederal Information Systems 

For the purposes of this analysis, it is 

assumed that the cost to a civilian 

agency to validate a contractor’s system 

security plan (see section IV.C.2.e. of 

this preamble) will be similar to the cost 

for DoD to perform a strategic High 

Confidence Level Assessment, 

approximately $51,097 per action. 

Therefore, the total annual estimated 

cost for civilian agencies to perform 

these validations is $5,620,670 (110 

non-defense contractor system security 

plan reviews * $51,097/review). 

7. Training Government Employees on 

New Requirements for CUI 

It is expected that the Government 

contracting officers, contract specialists, 

contracting officer representatives, and 

others involved in the acquisition 

process, such as program managers and 

those involved in the development of 

requirements documents, will be 

required to become familiar with the 

technical requirements of this rule and 

receive additional training. While the 

requirement to remain current on 

policies for Government procurement, 

such as changes to the FAR, is 

considered a part of the normal duties 

of such individuals, there is expected to 

be specialized Government training on 

this topic, the cost of which is attributed 

to this rule. It is estimated that 250,000 

Government employees may need to 

take 30 minutes of specialized training 

at an average wage rate equivalent to a 

GS–12, step 5, Government employee. 

Therefore, the estimated annual training 

cost is $9,000,000 (250,000 employees * 

0.5 hours/employee * $72/hour). 

E. Total Costs 

The total estimated costs (in billions) 

associated with this FAR rule over a tenyear period are as follows: 

Government Cost Undiscounted 2 percent 

Present Value .......................................................................................................................................................... $22.32 $20.10 

Annualized ............................................................................................................................................................... 2.23 2.24 

Undiscounted public and Government 

costs (in billions) by year over the tenyear period are summarized in the following table: 


lotter on DSK11XQN23PROD with PROPOSALS4
4286 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 

Year 1 Year 2 Year 3 Year 4 Year 5 Year 6 Year 7 Year 8 Year 9 Year 10 

$2.75 ............................................ $2.17 $2.17 $2.17 $2.17 $2.17 $2.17 $2.17 $2.17 $2.17 

F. Alternatives Considered 

1. Status Quo 

Absent this FAR rule, agencies will 

continue to employ ad hoc, agencyspecific policies to manage CUI. This 

approach can cause agencies to mark 

and handle this information 

inconsistently and inefficiently, and 

forces defense and non-defense 

contractors to establish procedures and 

internal controls to meet different 

civilian and defense agency approaches 

for marking and handling CUI. This 

approach was determined to be counter 

to the purpose of the Federal 

Acquisition Regulations System, which 

was established for the codification and 

publication of uniform policies and 

procedures for acquisition by all 

executive agencies (see FAR 1.101). 

2. No Standard Form 

The Government considered whether 

or not to establish a new standard form 

to communicate CUI requirements 

specific to the contract. As an 

alternative, the FAR could prescribe 

only a solicitation provision and 

contract clause to establish offeror and 

contractor responsibilities related to 

marking and handling CUI involved in 

the contract but would not dictate how 

agencies communicate what types of 

CUI may be involved in the contract. 

Given the importance of protecting CUI, 

it was determined that a Standard Form 

is the best way to ensure the 

Government is properly communicating 

specific CUI requirements for each 

contract. Absent a standard form, there 

is a risk that agencies may not provide 

enough information for contractors to 

understand what CUI is involved in the 

contract and what responsibilities they 

have with regard to this CUI. The 

standard form also provides a means for 

contractors to uniformly communicate 

CUI requirements to its subcontractors. 

3. 100 Percent Inspection 

Several aspects of this proposed rule 

require the contractor to provide 

information upon request. For example, 

contractors may be requested to submit 

supporting documentation to verify 

compliance with the system security 

plan required by NIST SP 800–171 

Revision 2 in instances where the 

Government is dealing with a CUI 

incident that is a confirmed breach or an 

agency determines that it is necessary to 

verify a contractor’s system security 

plan based on the criticality of a 

program and the CUI being handled on 

the contractor’s information system (see 

sections B.1.e. and D.1.g. of the 

Regulatory Impact Analysis). Similarly, 

when such CUI incidents have occurred, 

the Government may require the 

contractor to submit information to 

verify that the contractor and its 

subcontractors have provided 

appropriate training to their employees 

that handle CUI, as required by the 

clause at FAR 52.204–XX (see sections 

B.1.c. and D.1.b of the Regulatory 

Impact Analysis). 

As an alternative, the Government 

considered whether to require 

contractors to submit evidence of its 

system security plan and evidence that 

employees have been trained on an 

annual basis. However, defense 

contractors should have already 

implemented system security plans in 

accordance with DFARS clause 

252.204–7012 and non-defense 

contractors have incentive to ensure 

compliance with the requirements in 

FAR clause 52.204–XX to avoid liability 

for breaches of CUI that may result from 

improperly protecting CUI being 

handled on the contractor’s information 

system. As such, implementing a 100 

percent inspection requirement would 

unnecessarily and significantly increase 

the burden on contractors and the 

Government. 

4. Implementation of NIST SP 800–171 

Revision 3 

This proposed rule requires 

contractors to implement the 

requirements of NIST SP 800–171 

Revision 2. In May of 2024, NIST 

published Revision 3 to NIST SP 800– 

171 (see https://csrc.nist.gov/pubs/sp/ 

800/171/r3/final). The Government is 

currently assessing where the 

organizationally-defined parameters 

within Revision 3 should be 

standardized and implemented on a 

governmentwide basis. As stated in the 

benefits section of this rule, it is 

important for the Government to 

immediately implement requirements to 

protect CUI on non-Federal information 

systems; therefore, this proposed rule 

does not seek to implement NIST’s most 

recent revision. The FAR Council 

anticipates that future rulemaking will 

be initiated to update NIST SP 800–171 

and NIST SP 800–171A to the current 

version. 

V. Specific Questions for Public 

Comment 

To understand the exact scope of this 

impact and how this impact could be 

affected in the final rule, DoD, GSA, and 

NASA welcome input on the following 

questions regarding anticipated impact 

on affected parties. DoD, GSA, and 

NASA recognize that some agencies 

may need to tailor the approach to the 

information collected based on the 

unique mission and risks for their 

agency. 

1. Is there additional information or 

guidance you view as necessary to 

effectively comply with this rule? 

2. Are there specific situations you 

anticipate where your organization will 

be required to report on different 

timelines in order to comply with the 

CUI incident reporting requirements 

outlined in this proposed rule, other 

Federal contract requirements, or other 

regulations promulgated under Federal 

law? How would your organization 

handle disparate incident reporting 

timelines in other Federal Government 

contracting requirements or from other 

regulatory agencies? 

3. Incident response and associated 

reporting are often iterative processes, 

with system owners updating reports as 

a situation evolves and more data 

becomes available. What implications 

are there for your organization, 

including with respect to incident 

response, to meet disparate timelines for 

incident reporting? 

4. How much, if at all, would you 

estimate that the initial reporting 

requirement described in this proposed 

rule could increase the price of the 

products or services your organization 

provides to the Federal Government? 

5. Understanding evolving data 

capabilities may change the nature or 

sensitivity of information over time, are 

there specific concerns not adequately 

addressed in this proposed rule? If 

possible, please provide any relevant 

use cases. 

6. The FAR Council notes there is also 

what is referred to as ‘‘CUI specified’’, 

which is information that is considered 

CUI, but is also required to be handled 

in a certain way due to other laws, 

regulations, and policies (e.g., 

restrictions on disseminating 

information to foreign nationals or dual 

citizens under International Traffic in 

Arms Regulations (ITAR)). For CUI 

specified information, not only does it 

have to be treated and handled as CUI, 


lotter on DSK11XQN23PROD with PROPOSALS4
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4287 

but it also must be handled in 

accordance with the other applicable 

regulations and laws. Are there specific 

concerns not addressed in this proposed 

rule in this area? If so, please provide a 

relevant use case. 

VI. Executive Orders 12866 and 13563 

Executive Orders (E.O.s) 12866 (as 

amended by E.O. 14094) and 13563 

direct agencies to assess the costs and 

benefits of available regulatory 

alternatives and, if regulation is 

necessary, to select regulatory 

approaches that maximize net benefits 

(including potential economic, 

environmental, public health and safety 

effects, distributive impacts, and 

equity). E.O. 13563 emphasizes the 

importance of quantifying both costs 

and benefits, of reducing costs, of 

harmonizing rules, and of promoting 

flexibility. This is a significant 

regulatory action and, therefore, was 

subject to review under section 6(b) of 

E.O. 12866, Regulatory Planning and 

Review, dated September 30, 1993. 

VII. Regulatory Flexibility Act 

DoD, GSA, and NASA expect this 

proposed rule, if finalized, to have a 

significant economic impact on a 

substantial number of small entities 

within the meaning of the Regulatory 

Flexibility Act, 5 U.S.C. 601–612. The 

Initial Regulatory Flexibility Analysis 

(IRFA) is summarized as follows: 

DoD, GSA, and NASA are proposing 

to revise the FAR to implement a NARA 

final rule on the Federal CUI Program as 

it relates to performance under Federal 

contracts (see 32 CFR part 2002). 

This proposed rule creates two new 

clauses at FAR 52.204–XX, Controlled 

Unclassified Information, and FAR 

52.204–YY, Identifying and Reporting 

Information That Is Potentially 

Controlled Unclassified Information, 

and a new FAR provision at 52.204– 

WW, Notice of Controlled Unclassified 

Information Requirements. These 

clauses and the provision work together 

to implement a uniform way for Federal 

agencies, offerors, and contractors to 

manage CUI. The rule also creates a new 

standard form (SF) XXX to standardize 

the way in which the Government 

identifies CUI that will be managed and 

safeguarded by a contractor in 

performance of a contract. This rule is 

just one element of a larger strategy to 

improve the Government’s efforts to 

identify, deter, protect against, detect, 

and respond to increasingly 

sophisticated attacks by criminals and 

our adversaries targeting Federal 

information and information systems. 

Promulgation of this FAR rule is 

authorized by 41 U.S.C. 1121(b); 41 

U.S.C. 1303; 40 U.S.C. 121(c); 10 U.S.C. 

chapter 4 and 10 U.S.C. chapter 137 

legacy provisions (see 10 U.S.C. 3016); 

and 51 U.S.C. 20113. 

This rule will apply to small 

businesses that are awarded 

Government contracts, other than those 

that receive awards exclusively for 

COTS items. According to award data in 

the Federal Procurement Data System 

(FPDS) for fiscal years (FY) 2021 

through FY 2023, on average per year 

the Government awards contracts and 

orders for supplies and services 

(excluding those for supplies purchased 

using commercial item procedures) to 

67,547 unique contractors, of which 

44,152 (65 percent) are small 

businesses. 

When an SF XXX is incorporated in 

the contract and identifies CUI that will 

be involved in the contract, the 

contractor will be subject to the new 

FAR clause at FAR 52.204–XX and more 

robust compliance requirements for 

safeguarding the CUI. Per the FPDS 

data, of the contractors that receive 

covered awards each year, 

approximately 37,933 are non-defense 

contractors and 29,614 are defense 

contractors, or contractors that do 

business with both civilian agencies and 

DoD. Based on consultation with subject 

matter experts, it is assumed that 18 

percent of non-defense contractors 

(6,828) and 28 percent of defense 

contractors (8,292), or 15,120 total 

contractors, may receive awards each 

year that include an SF XXX listing CUI 

and the associated safeguarding 

requirements. It is further assumed that 

the ratio of subcontractors to prime 

contractors that handle CUI is 0.5:1, or 

7,560 total subcontractors. 

Therefore, each year, an estimated 

22,680 contractors and subcontractors, 

of which 15,809 (70 percent) are 

estimated to be small businesses, will be 

required to safeguard CUI in 

performance of a contract, pursuant to 

the new clause at FAR 52.204–XX and 

the instructions provided on an SF 

XXX. These small entities may be 

impacted by the various compliance 

requirements in the clause, depending 

on the type of CUI required to be 

handled under the contract or 

subcontract, the way in which the 

information will be handled, and 

whether those small businesses have 

already been safeguarding sensitive 

Government information under other 

contract provisions. 

The new FAR clause at 52.204–XX is 

modeled after the existing clause at 

DFARS 252.204–7012, Safeguarding 

Covered Defense Information and Cyber 

Incident Reporting, the most recent 

version of which has been in effect since 

2017 (the clause has been in effect since 

2013, and the NIST SP 800–171 

requirements were added in 2015). As 

such, small businesses that do business 

with DoD and handle CUI in 

performance of their contracts are 

already subject to requirements 

equivalent to the new FAR clause and 

provision. In addition, small businesses 

that do business with other agencies 

that have included similar or 

overlapping safeguarding requirements 

under agency-specific contract terms 

may already be in partial or substantial 

compliance with the clause 

requirements. 

The following specific compliance 

requirements will apply to all Federal 

offerors, contractors, and 

subcontractors: 

• Review and Distribute the SF XXX. 

When the contract includes an SF XXX 

that identifies CUI to be safeguarded 

under the contract, the contract will 

include the CUI clause. The contractor 

or subcontractor will need to review the 

SF XXX to determine what information 

under the contract is considered CUI 

and subject to the compliance 

requirements of the CUI clause. If the 

contractor or subcontractor intends to 

flow down CUI in performance of the 

contract or subcontract, then the 

contractor or subcontractor will need to 

prepare an SF XXX, as appropriate for 

CUI that will flow down, and distribute 

it to the subcontractor that will be 

handling CUI. 

• Train Contractor Employees on 

Handling CUI. Per the CUI clause, a 

contractor shall not permit any 

contractor employee to have, retain 

access to, create, collect, use, process, 

store, maintain, disseminate, disclose, 

dispose of, or otherwise handle, CUI 

unless the employee has completed 

training on properly handling CUI that, 

at a minimum, includes the elements 

required in the SF XXX. The SF XXX 

will also specify the frequency at which 

a contractor must provide the training, 

which is dependent on the type of CUI 

being handled by the contractor’s 

employees and the criticality of the 

program being supported. The 

contractor must provide evidence of 

employee training upon request by the 

contracting officer; however, such 

requests are expected to be limited to, 

for example, instances where the 

Government is dealing with a CUI 

incident, or where an agency determines 

that it is necessary to verify training 

based on the criticality of a program and 

the CUI being handled by the contractor. 

• Comply with NIST SP 800–172. A 

limited number of contractors may be 

required under FAR clause 52.204–XX, 

Controlled Unclassified Information, to 


lotter on DSK11XQN23PROD with PROPOSALS4
4288 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 

implement some or all requirements of 

NIST SP 800–172, Enhanced Security 

Requirements for Protecting Controlled 

Unclassified Information: A Supplement 

to NIST Special Publication 800–171, 

Revision 2. NIST SP 800–172 provides 

enhanced security requirements that 

apply only to components of nonfederal 

systems that process, store, or transmit 

CUI or that provide security protection 

for such components when the 

designated CUI is associated with a 

critical program or high-value asset. The 

enhanced requirements supplement the 

basic and derived security requirements 

in NIST Special Publication 800–171, 

Revision 2, and address the protection 

of CUI by promoting: penetrationresistant architecture, damage-limiting 

operations, and designs to achieve cyber 

resiliency and survivability. 

• Submit Supporting Documentation 

to Verify Compliance. Per FAR clause 

52.204–XX, Controlled Unclassified 

Information, upon request, a contractor 

shall submit the description of the 

system security plan required by NIST 

SP 800–171, Revision 2, (and NIST SP 

800–172, when applicable) and any 

associated plans of action for any 

planned implementations or mitigations 

to the Government to demonstrate the 

contractor’s implementation or planned 

implementation of the security 

requirements. Requests for the system 

security plan are expected to be rare or 

limited to, for example, instances where 

the Government is dealing with a CUI 

incident, or an agency determines that 

it is necessary to verify a contractor’s 

system security plan based on the 

criticality of a program and the CUI 

being handled on the contractor’s 

information system. 

• Comply with any additional 

security requirements identified in the 

Requirements Document. In addition to 

the security requirements outlined in 

the SF XXX and the CUI clause, the 

requirements document in the contract 

may require the Contractor to comply 

with additional security requirements 

beyond NIST SP 800–171, Revision 2, to 

address unique requirements to protect 

CUI Basic at higher than the moderate 

confidentiality level in accordance with 

32 CFR 2002.14(h)(2). The Contractor 

shall also implement additional 

information security requirements it 

reasonably determines necessary to 

provide adequate security in a dynamic 

environment. 

• Comply with Additional 

Notification Requirements. Unmarked 

or mismarked CUI is not considered a 

CUI incident if the mismarking has not 

resulted in the mishandling or improper 

dissemination of the information. Per 

the new solicitation provision and 

contract clauses, offerors are requested 

and contractors are required to notify 

the Contracting Officer Representative 

or other designated agency official 

concerning any unmarked or mismarked 

CUI if discovered. Such occurrences are 

expected to be rare. 

• Comply with Additional Marking 

Requirements. To the maximum extent 

practicable, offerors and contractors are 

required to identify and mark any 

proprietary business or contractorattributional information. 

The following compliance 

requirements are attributed only to nondefense contractors and subcontractors 

that handle CUI, since defense 

contractors are already required to 

comply with these requirements 

pursuant to DFARS clause 252.204– 

7012: 

• Comply with NIST SP 800–171, 

Revision 2. If the Contractor is operating 

a non-Federal information system that 

processes, stores, or transmits CUI 

identified in the contract, the CUI clause 

requires the contractor to comply with 

the security requirements in NIST 

Special Publication 800–171, Revision 

2, or as authorized by the Contracting 

Officer and any CUI specified 

requirements identified in the SF XXX. 

NIST SP 800–171 Revision 2 includes 

110 security requirements for nonFederal information systems that can be 

grouped into the following 14 

categories: access control, awareness 

and training, audit and accountability, 

configuration management, 

identification and authentication, 

incident response, maintenance, media 

protection, personnel security, physical 

protection, risk assessment, security 

assessment, system and 

communications protection, and system 

and information integrity. Specific 

information on the 110 individual 

security requirements and various 

templates are available on the NIST 

website at https://csrc.nist.gov/ 

publications/detail/sp/800-171/rev-2/ 

final. Federal contractors that handle 

covered Federal information (CFI), a 

much broader category than CUI, on 

their information systems are already 

required to have implemented 17 of the 

110 security requirements, which are 

already included in the clause at FAR 

52.204–21, Basic Safeguarding of 

Covered Contractor Information 

Systems. Such requirements are 

considered ‘‘met’’ by all impacted 

contractors, regardless of size. For the 

remaining 93 security requirements, a 

contractor may need to establish a 

process or procedure, configure existing 

information technology that the 

contractor already owns, or acquire 

additional software or hardware. 

• Assess and report suspected CUI 

incidents. When the Contractor 

discovers a suspected CUI incident, the 

CUI clause requires the contractor to 

determine what CUI was or could have 

been improperly accessed, used, 

processed, stored, maintained, 

disseminated, disclosed, or disposed of; 

construct a timeline of user activity; and 

determine methods and techniques used 

to access CUI. The Contractor shall 

report any suspected or confirmed CUI 

incident to the agency website or point 

of contact identified in the SF XXX, 

within 8 hours of discovery. The report 

shall include as many of the applicable 

data elements located on the DIBNet 

website as are available and provide any 

remaining applicable data elements as 

soon as they become available. In 

addition, if the Contractor is a 

FedRAMP authorized (Joint 

Authorization Board or Agency) Cloud 

Service Provider, the Contractor shall 

also report to the points of contact 

specified in the FedRAMP incident 

reporting guidelines as documented in 

the Cloud Service Provider Incident 

Response Plan. The requirements of the 

CUI clause are flowed down to 

subcontracts at all tiers; subcontractors 

are required to notify the prime 

contractor or next higher-tier 

subcontractor within the same 

timeframes. 

• Preserve and protect images for 

suspected CUI incidents and submit 

media and data for damage 

assessments. If a suspected or confirmed 

CUI incident has occurred on an 

information system, the CUI clause 

requires the Contractor shall preserve 

and protect images of all known affected 

information systems and all relevant 

monitoring and packet capture data for 

at least 90 days from the submission of 

the report to allow the Government to 

request the media and data or decline 

interest during this 90-day period, after 

which, if no request has been made, the 

images need no longer be preserved. 

• Cooperate with Validation Actions 

for Non-Federal Information Systems. 

The CUI clause requires the Contractor 

to cooperate with validation actions 

conducted by an agency in accordance 

with NIST SP 800–171A, Assessing 

Security Requirements for Controlled 

Unclassified Information, and if 

applicable, NIST SP 800–172A for 

enhanced security requirements. These 

types of validation actions are similar to 

the DoD’s Strategic High Confidence 

Level Assessments being conducted by 

DoD pursuant to the clause at DFARS 

252.204–7020, and NIST SP 800–171 

DoD Assessment Requirements, 

whereby the Government reviews the 

system security plan description of how 


lotter on DSK11XQN23PROD with PROPOSALS4
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4289 

each security requirement is met and 

the contractor demonstrates its 

implementation. While cooperating 

with validation actions, a contractor 

may need to provide the Government 

access to its facilities, systems, and 

personnel. 

• Comply with NIST SP 800–53. The 

CUI clause requires the Contractor, 

when it is operating an information 

system identified in the SF XXX as a 

Federal information system that 

processes, stores, or transmits CUI 

identified in the contract, to comply 

with agency-identified security controls 

from NIST Special Publication 800–53 

and any CUI Specified requirements 

identified in the SF XXX. In addition, 

cloud service providers must meet 

security requirements established by the 

Government for the Federal Risk and 

Authorization Management Program 

(FedRAMP) Moderate Baseline (https:// 

www.fedramp.gov/documents/). 

The total estimated cost of 

compliance for small businesses is 

$937,017,841 in the initial year of 

implementation and $564,187,237 in 

each subsequent year. The cost per 

entity is dependent on whether the 

small business is required to implement 

NIST SP 800–171 Revision 2 or NIST SP 

800–172 on their information systems. 

For more information on the specific 

compliance requirements and the 

expected cost impact on contractors, see 

section IV.C. of this preamble. A 

Regulatory Impact Analysis that 

includes a detailed discussion and 

explanation about the assumptions and 

methodology used to estimate the cost 

of this regulatory action, including the 

specific impact and costs for small 

businesses, is available at 

www.regulations.gov (search for ‘‘FAR 

Case 2017–016’’ click ‘‘Open Docket,’’ 

and view ‘‘Supporting Documents’’). 

This proposed rule does not 

duplicate, overlap, or conflict with any 

other Federal rules. This proposed rule 

implements the requirements of 32 CFR 

part 2002 to ensure uniform 

implementation of Federal contractor 

requirements for managing CUI. 

While this rule is modeled after 

DFARS clause 252.204–7012, it does not 

conflict with the existing clause. It is 

expected that the DFARS clause will be 

amended in the future to address DoDspecific requirements that may be in 

addition to the FAR clause. 

DoD, GSA, and NASA were unable to 

identify any alternatives that would 

reduce the burden on small entities and 

still meet the objectives of 32 CFR part 

2002. It is not possible to establish 

different compliance standards that take 

into account the resources available to 

small entities or exempt small entities 

from the rule, or any part thereof, that 

does not increase the risk of CUI 

incidents. However, by implementing a 

more standardized set of requirements 

for contractor information systems and 

for CUI safeguarding across agencies, 

small businesses that engage in 

contracts involving sensitive 

Government information might find it 

easier and less costly to meet security 

requirements for such information 

under this rule, because the variation of 

system configurations and requirements 

will be significantly reduced. This, in 

turn, may make such businesses more 

competitive for future Government 

contracts. 

The Regulatory Secretariat Division 

has submitted a copy of the IRFA to the 

Chief Counsel for Advocacy of the Small 

Business Administration. A copy of the 

IRFA may be obtained from the 

Regulatory Secretariat Division. DoD, 

GSA, and NASA invite comments from 

small business concerns and other 

interested parties on the expected 

impact of this proposed rule on small 

entities. 

DoD, GSA, and NASA will also 

consider comments from small entities 

concerning the existing regulations in 

subparts affected by the rule in 

accordance with 5 U.S.C. 610. Interested 

parties must submit such comments 

separately and should cite 5 U.S.C. 610 

(FAR Case 2017–016), in 

correspondence. 

VIII. Paperwork Reduction Act 

The Paperwork Reduction Act (44 

U.S.C. 3501–3521) applies because the 

proposed rule contains information 

collection requirements. Accordingly, 

the Regulatory Secretariat Division has 

submitted a request for approval of a 

new information collection requirement 

concerning controlled unclassified 

information to the Office of 

Management and Budget. 

A. Public Burden for This Collection of 

Information 

1. System Security Plan. Public 

reporting burden for this collection of 

information is estimated to average 0.50 

hour per response including the time to 

prepare and submit the plan. 

The annual reporting burden is 

estimated as follows: 

Respondents: 1,430. 

Total annual responses: 1,430. 

Total burden hours: 715. 

This estimate is based on 

approximately one response per 

respondent. 

The annual recordkeeping burden is 

estimated as follows: 

Recordkeepers: 10,242. 

Total annual records: 10,242. 

Total recordkeeping burden hours: 

122,904. 

This estimate is based on one 

recordkeeper who spends one hour per 

month (or 12 hours per year) 

maintaining the system security plan. 

2. Preserve, Protect, and Submit 

Media and Data. Public reporting 

burden for this collection of information 

is estimated to average 2.5 hours per 

response including the time to prepare 

and complete the submission. 

The annual reporting burden is 

estimated as follows: 

Respondents: 48. 

Total annual responses: 48. 

Total burden hours: 120. 

This estimate is based on 

approximately one response per 

respondent. 

The annual recordkeeping burden is 

estimated as follows: 

Recordkeepers: 580. 

Total annual records: 580. 

Total recordkeeping burden hours: 

4,350. 

This estimate is based on one 

recordkeeper who spends 7.5 hours per 

year to preserve and protect images of 

all known affected information systems 

and all relevant monitoring and packet 

capture data, assuming 0.5 hours to 

image, 2 hours to preserve monitoring 

and packet capture data, and 5 hours to 

upload images and set up storage space. 

3. CUI Incident Reporting. Public 

reporting burden for this collection of 

information is estimated to average 5 

hours per response including the time to 

prepare and submit a CUI incident 

report. 

The annual reporting burden is 

estimated as follows: 

Respondents: 580. 

Total annual responses: 580. 

Total burden hours: 2,900. 

This estimate is based on 

approximately one response per 

respondent. 

4. Training Records. Public reporting 

burden for this collection of information 

is estimated to average 15 minutes (0.25 

hour) per response including the time to 

prepare and submit the evidence of 

training. 

The annual reporting burden is 

estimated as follows: 

Respondents: 1,430. 

Total annual responses: 1,430. 

Total burden hours: 357.5. 

This estimate is based on 

approximately one response per 

respondent. 

The annual recordkeeping burden is 

estimated as follows: 

Recordkeepers: 53,225. 

Total annual records: 2,191,400. 

Total recordkeeping burden hours: 

181,886. 


lotter on DSK11XQN23PROD with PROPOSALS4
4290 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 

This estimate is based on one 

recordkeeper who spends 5 minutes 

(0.083 hours) per record maintaining the 

employee training certificates. 

5. Prepare and Distribute the SF XXX. 

Public reporting burden for this 

collection of information is estimated to 

average 2 hours per response including 

the time to prepare and distribute the SF 

XXX. 

The annual reporting burden is 

estimated as follows: 

Respondents: 22,680. 

Total annual responses: 517,392. 

Total burden hours: 1,034,784. 

B. Request for Comments Regarding 

Paperwork Burden 

Submit comments on this collection 

of information no later than March 17, 

2025 through https://

www.regulations.gov and follow the 

instructions on the site. All items 

submitted must cite OMB Control No. 

9000–XXXX, Controlled Unclassified 

Information. Comments submitted in 

response to this rule will be made 

publicly available and are subject to 

disclosure under the Freedom of 

Information Act. For this reason, please 

do not include in your comments 

information of a confidential nature, 

such as sensitive personal information 

or proprietary information, or any 

information that you would not want 

publicly disclosed unless you follow the 

instructions below for confidential 

comments. Summary information of the 

public comments received, including 

any specific comments, will be posted 

on https://www.regulations.gov. 

All filers using the portal should use 

the name of the person or entity 

submitting comments as the name of 

their files, in accordance with the 

instructions below. Anyone submitting 

business confidential/proprietary 

information should clearly identify any 

business confidential/proprietary 

portion at the time of submission, file a 

statement justifying nondisclosure and 

referencing the specific legal authority 

claimed, and provide a nonconfidential/non-proprietary version of 

the submission. Any business 

confidential information should be in an 

uploaded file that has a file name 

beginning with the characters ‘‘BC.’’ 

Any page containing business 

confidential information must be clearly 

marked ‘‘BUSINESS CONFIDENTIAL/ 

PROPRIETARY’’ on the top of that page. 

The corresponding non-confidential/ 

non-proprietary version of those 

comments must be clearly marked 

‘‘PUBLIC.’’ The file name of the nonconfidential version should begin with 

the character ‘‘P.’’ The ‘‘BC’’ and ‘‘P’’ 

should be followed by the name of the 

person or entity submitting the 

comments or rebuttal comments. All 

filers should name their files using the 

name of the person or entity submitting 

the comments. Any submissions with 

file names that do not begin with a ‘‘BC’’ 

will be assumed to be public and will 

be made publicly available through 

https://www.regulations.gov. 

To confirm receipt of your 

comment(s), please check https://

www.regulations.gov, approximately 

two-to-three days after submission to 

verify posting. If there are difficulties 

submitting comments, contact the GSA 

Regulatory Secretariat Division at 202– 

501–4755 or GSARegSec@gsa.gov. 

Public comments are particularly 

invited on: 

• The necessity of this collection of 

information for the proper performance 

of the functions of Federal Government 

acquisitions, including whether the 

information will have practical utility; 

• The accuracy of the estimate of the 

burden of this collection of information; 

• Ways to enhance the quality, utility, 

and clarity of the information to be 

collected; and 

• Ways to minimize the burden of the 

collection of information on 

respondents, including the use of 

automated collection techniques or 

other forms of information technology. 

Requesters may obtain a copy of the 

supporting statement from the General 

Services Administration, Regulatory 

Secretariat Division by calling 202–501– 

4755 or emailing GSARegSec@gsa.gov. 

Please cite OMB Control Number 9000– 

XXXX, Controlled Unclassified 

Information, in all correspondence. 

List of Subjects in 48 CFR Parts 1, 2, 3, 

4, 5, 7, 9, 11, 12, 15, 27, 33, 42, 52, and 

53 

Government procurement. 

William F. Clark, 

Director, Office of Government-wide 

Acquisition Policy, Office of Acquisition 

Policy, Office of Government-wide Policy. 

Therefore, DoD, GSA, and NASA 

propose amending 48 CFR parts 1, 2, 3, 

4, 5, 7, 9, 11, 12, 15, 27, 33, 42, 52, and 

53 as set forth below: 

■ 1. The authority citation for 48 CFR 

Parts 1, 2, 3, 4, 5, 7, 9, 11, 12, 15, 27, 

33, 42, 52, and 53 continues to read as 

follows: 

Authority: 40 U.S.C. 121(c); 10 U.S.C. 

chapter 4 and 10 U.S.C. chapter 137 legacy 

provisions (see 10 U.S.C. 3016); and 51 

U.S.C. 20113. 

PART 1—FEDERAL ACQUISITION 

REGULATIONS SYSTEM 

■ 2. In section 1.106 amend in the table 

following the introductory text, by 

adding in numerical order, entries for 

‘‘52.204–WW’’ and ‘‘52.204–XX’’ to read 

as follows: 

1.106 OMB approval under the Paperwork 

Reduction Act. 

* * * * * 

FAR segment OMB control No. 

* * * * * 

52.204–WW ...................... 9000–XXXX 

52.204–XX ........................ 9000–0182 and 

9000–XXXX 

* * * * * 

* * * * * 

PART 2—DEFINITIONS OF WORDS 

AND TERMS 

■ 3. Amend section 2.101 by— 

■ a. Adding in alphabetical order the 

definitions for ‘‘Contractor-attributional 

information’’, ‘‘Controlled unclassified 

information (CUI)’’, ‘‘CUI incident’’, 

‘‘CUI Registry’’, ‘‘Federal information 

system’’, and ‘‘Information system’’; and 

■ b. Removing the definition for 

‘‘Federally controlled information 

system’’. 

The additions read as follows: 

2.101 Definitions. 

* * * * * 

Contractor-attributional information 

means information that identifies the 

contractor or its employees directly or 

identifies them indirectly by grouping 

information that can be traced back to 

the contractor (e.g., program description 

or facility locations). 

* * * * * 

Controlled unclassified information 

(CUI) means information that the 

Government creates or possesses, or that 

an entity creates or possesses for or on 

behalf of the Government, that a law, 

regulation, or Governmentwide policy 

requires or permits an agency to handle 

using safeguarding or dissemination 

controls. CUI does not include— 

(1) Classified information; 

(2) Covered Federal information (see 

4.404–1); 

(3) Information a contractor possesses 

and maintains in its own systems that 

did not come from, or was not created 

or possessed by or for, an executive 

branch agency or an entity acting for an 

agency (see 32 CFR 2002.4); or 

(4) Federally-funded basic and 

applied research in science, technology, 

and engineering at colleges, universities, 

and laboratories in accordance with 

National Security Decision Directive 

189. 

* * * * * 


lotter on DSK11XQN23PROD with PROPOSALS4
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4291 

CUI incident means suspected or 

confirmed improper access, use, 

disclosure, modification, or destruction 

of CUI, in any form or medium. 

CUI Registry means the online 

repository for all information, guidance, 

policy, and requirements on handling 

CUI. Among other information, the CUI 

Registry identifies all approved CUI 

categories and subcategories, provides 

general descriptions for each, identifies 

the basis for controls, establishes 

markings, and includes guidance on 

handling procedures (see https://

www.archives.gov/cui). 

* * * * * 

Federal information system means an 

information system (44 U.S.C. 3502(8)) 

used or operated by an agency, by a 

contractor of an agency, or by another 

organization on behalf of an agency. 

* * * * * 

Information system means a discrete 

set of information resources organized 

for the collection, processing, 

maintenance, use, sharing, 

dissemination, or disposition of 

information (44 U.S.C. 3502(8)). 

* * * * * 

PART 3—IMPROPER BUSINESS 

PRACTICES AND PERSONAL 

CONFLICTS OF INTEREST 

■ 4. Amend section 3.104–4 by— 

■ a. Revising the section heading; 

■ b. Removing paragraph (c); 

■ c. Redesignating paragraph (b) as 

paragraph (c); 

■ d. Adding a new paragraph (b); 

■ e. Revising the newly redesignated 

paragraph (c); 

■ f. Revising paragraph (d); and 

■ g. Removing from paragraph (e)(1) the 

words ‘‘A contractor’’ and adding ‘‘An 

offeror or contractor’’ in its place. 

The revisions and additions read as 

follows: 

3.104–4 Disclosure, protection, and 

marking of contractor information. 

* * * * * 

(b)(1) The clause at 52.204–XX, 

Controlled Unclassified Information, 

directs offerors and contractors to 

indicate or otherwise identify any 

contractor bid or proposal information, 

contractor-attributional information, 

proprietary business information, and 

source selection information submitted 

to the Government. The contracting 

officer should consult with the 

contractor if the contracting officer is 

unsure whether information provided 

by the contractor falls into one of these 

categories. 

(2) Individuals responsible for 

preparing material that may be source 

selection information as described at 

paragraph (10) of the ‘‘source selection 

information’’ definition in 2.101 must 

mark the cover page and each page that 

the individual believes contains source 

selection information with the legend 

‘‘Source Selection Information-See FAR 

2.101 and 3.104.’’ Although the 

information in paragraphs (1) through 

(9) of the definition in 2.101 is 

considered to be source selection 

information whether or not marked, all 

reasonable efforts must be made to mark 

such material with the same legend. 

(c) Contractor bid or proposal 

information, contractor-attributional 

information, proprietary business 

information, and source selection 

information must be marked and 

protected from unauthorized disclosure 

in accordance with 4.403, 14.401, 

15.207, applicable law, and regulations, 

including 32 CFR part 2002. If the 

offeror or contractor submits 

information that could be controlled 

unclassified information (e.g., 

proprietary business information), the 

contracting officer shall determine 

whether the information must be 

marked and protected in accordance 

with applicable law, policy, guidance, 

and agency procedures. Individuals who 

are unsure how to handle such 

information should consult with agency 

officials as necessary. 

(d) Except as provided in paragraph 

(d)(3) of this section, the contracting 

officer must promptly notify the offeror 

or contractor in writing if the 

contracting officer believes that 

contractor proprietary business 

information, contractor-attributional 

information, contractor bid or proposal 

information, or information marked in 

accordance with 52.215–1(e) has been 

inappropriately marked. Notification 

should occur upon discovery and may 

be made prior to award. The offeror or 

contractor that has affixed the marking 

must be given an opportunity to justify 

the marking. 

(1) If the offeror or contractor agrees 

that the marking is not justified or does 

not respond within the time specified in 

the notice, the contracting officer may 

remove the marking and release the 

information. 

(2) If, after reviewing the contractor’s 

justification, the contracting officer 

determines that the marking is not 

justified, the contracting officer must 

notify the offeror or contractor in 

writing before releasing the information. 

(3) For technical data marked as 

proprietary by an offeror or contractor, 

the contracting officer must follow the 

procedures in 27.404–5. 

* * * * * 

PART 4—ADMINISTRATIVE AND 

INFORMATION MATTERS 

■ 5. Revise the heading of subpart 4.4 to 

read as follows: 

Subpart 4.4—Safeguarding Information 

and Information Systems 

■ 6. Add section 4.401 to read as 

follows: 

4.401 Definition. 

Information, as used in this subpart, 

means any communication or 

representation of knowledge such as 

facts, data, or opinions in any medium 

or form, including textual, numerical, 

graphic, cartographic, narrative, 

electronic, or audiovisual forms (see 

Office of Management and Budget 

(OMB) Circular A–130). 

4.402 [Redesignated as 4.402–1] 

■ 7. Redesignate section 4.402 as section 

4.402–1. 

■ 8. Add section 4.402 to read as 

follows: 

4.402 Classified information. 

4.403 [Redesignated as 4.402–2]. 

■ 9. Redesignate section 4.403 as section 

4.402–2. 

■ 10. Amend the newly redesignated 

section 4.402–2 by— 

■ a. Revising paragraphs (b)(2)(i) and 

(ii); and 

■ b. Removing from paragraph (c)(1) the 

reference ‘‘4.402(d)(1)’’ and adding 

‘‘4.402–1(d)(1)’’ in its place. 

The revisions read as follows: 

4.402–2 Responsibilities of contracting 

officers. 

* * * * * 

(b) * * * 

(2) * * * 

(i) An appropriate Security 

Requirements clause in the solicitation 

(see 4.402–3(a)); and 

(ii) As appropriate, in solicitations 

and contracts when the contract may 

require access to classified information, 

a requirement for security safeguards in 

addition to those provided in the clause 

52.204–2, Security Requirements for 

Classified Information. 

* * * * * 

■ 11. Add sections 4.402–3, and 4.403 

through 4.403–7 to read as follows: 

4.402–3 Contract clause. 

(a) The contracting officer shall insert 

the clause at 52.204–2, Security 

Requirements for Classified Information, 

in solicitations and contracts when the 

contract may require access to classified 

information, unless the conditions 

specified in paragraph (d) of this section 

apply. 


lotter on DSK11XQN23PROD with PROPOSALS4
4292 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 

(b) If a cost contract (see 16.302) for 

research and development with an 

educational institution is contemplated, 

the contracting officer shall use the 

clause with its Alternate I. 

(c) If a construction or architectengineer contract under which 

employee identification is required for 

security reasons is contemplated, the 

contracting officer shall use the clause 

with its Alternate II. 

(d) If the contracting agency is not 

covered by the NISP and has prescribed 

a clause and alternates that are 

substantially the same as those at 

52.204–2, the contracting officer shall 

use the agency-prescribed clause as 

required by agency procedures. 

4.403 Controlled unclassified information 

(CUI). 

4.403–1 Definitions. 

As used in section 4.403— 

CUI Basic means the subset of CUI for 

which the authorizing law, regulation, 

or Governmentwide policy does not set 

out specific handling or dissemination 

controls. CUI Basic must be handled 

according to the uniform set of controls 

set forth in 32 CFR part 2002 and the 

CUI Registry. 

CUI Categories means those types of 

information for which laws, regulations, 

or Governmentwide policies require or 

permit agencies to exercise safeguarding 

or dissemination controls, and which 

has been listed in the CUI Registry. 

CUI Specified means the subset of CUI 

for which the authorizing law, 

regulation, or Governmentwide policy 

contains specific handling controls that 

it requires or permits agencies to use 

and that differ from those for CUI Basic. 

The CUI Registry indicates which laws, 

regulations, and Governmentwide 

policies include such specific 

requirements. 

Handling means any use of CUI, 

including but not limited to collecting, 

developing, receiving, transmitting, 

storing, marking, safeguarding, 

transporting, disseminating, reusing, 

and disposing of the information. 

Lawful Government purpose means 

any activity, mission, function, 

operation, or endeavor that the 

Government authorizes or recognizes as 

within the scope of its legal authorities 

or the legal authorities of non-executive 

branch entities such as State and local 

law enforcement. 

Limited dissemination control means 

any control identified on the CUI 

Registry that agencies may use to limit 

or specify CUI dissemination. 

On behalf of an agency means a 

contractor uses or operates an 

information system or maintains or 

collects information for the purpose of 

processing, storing, or transmitting 

Federal information, and those activities 

are not incidental to providing a service 

or product to the Government. 

4.403–2 General. 

(a) Executive Order 13556 of 

November 4, 2010, entitled ‘‘Controlled 

Unclassified Information,’’ establishes a 

program to standardize executive 

branch management of information that 

requires safeguarding or dissemination 

controls. The National Archives and 

Records Administration’s (NARA) 

Information Security Oversight Office 

(ISOO) is the executive agent for the 

Controlled Unclassified Information 

Program. 

(b) This section implements 32 CFR 

part 2002, Controlled Classified 

Information (CUI). 

(c) Part 24, Protection of Privacy and 

Freedom of Information, contains 

additional policy and procedures for 

safeguarding records that are protected 

by the Privacy Act. 

(d) Part 27, Patents, Data, and 

Copyrights, contains policy and 

procedures for safeguarding information 

in patent applications and patents. 

4.403–3 Applicability. 

(a) The requirements for safeguarding 

CUI in this section apply when an 

offeror or contractor is expected to 

handle CUI, including instances when 

CUI resides on or transits through 

contractor information systems or 

within contractor facilities. 

(b) The CUI requirements in the 

clause at 52.204–XX, Controlled 

Unclassified Information, apply when 

CUI will be involved in the contract. 

The CUI requirements in the clause at 

52.204–YY, Identifying and Reporting 

Information That Is Potentially 

Controlled Unclassified Information, 

apply when no CUI will be involved in 

the contract. 

4.403–4 Policy. 

(a) The requiring activity will identify 

any CUI in the standard form (SF) XXX, 

Controlled Unclassified Information 

(CUI) Requirements, which must be 

incorporated in the contract. Contractors 

are required to safeguard only the CUI 

that is identified in the SF XXX. 

However, see 52.204–XX(c)(2). 

(b) Offerors and contractors are 

required to safeguard CUI pursuant to 

section 4.403–2. For CUI identified on 

an SF XXX that is incorporated into a 

contract, the contractor shall comply 

with the CUI requirements in the clause 

at 52.204–XX and on the form itself. 

(c) Unmarked or mismarked CUI is 

not considered a CUI incident unless 

the mismarking or lack of marking has 

resulted in the mishandling or improper 

dissemination of the information. 

Offerors are requested, and contractors 

are required, to notify the Government 

within 8 hours of discovery if they 

discover during the solicitation phase or 

performance of a contract any 

information they suspect is CUI, but is 

not listed on an SF XXX or is not 

marked or properly marked as required 

by an SF XXX. Offerors and contractors 

are not responsible for identifying or 

marking unmarked or mismarked CUI 

that is not identified in the SF XXX. 

(d) The Government shall protect 

against the improper use or release of 

information that includes contractor 

proprietary business information or 

contractor-attributional information to 

the extent required by law. 

(e) Applicable CUI requirements can 

be waived by the Government in 

accordance with 32 CFR 2002.38. 

4.403–5 Procedures. 

(a) For each requirement, except those 

exclusively for the acquisition of 

commercially available off-the-shelf 

items, the contracting officer shall 

obtain from the requiring activity an SF 

XXX that— 

(1) Identifies what CUI is involved in 

the contract; 

(2) Specifies if and how the contractor 

is to mark CUI involved in the contract 

(e.g., when the contractor is generating 

or developing the CUI, or when the 

purpose of the contract is to mark CUI); 

and 

(3) Conforms to 11.002(i). 

(b)(1) If the contracting officer has a 

reason to question the information on 

the SF XXX, the contracting officer shall 

request that the requiring activity verify 

that the SF XXX is accurate. 

(2) If the requiring activity has marked 

the ‘‘Yes’’ box in Part A of SF XXX, the 

contracting officer shall incorporate the 

SF in the solicitation and contract and 

the clause at 52.204–XX, as prescribed 

at 4.403–7, to communicate 

requirements for safeguarding CUI 

during contract performance. 

(3) If the requiring activity has marked 

the ‘‘No’’ box in Part A of SF XXX, the 

contracting officer shall include in the 

contract file a copy of the SF XXX and 

include in the solicitation and contract 

the clause at 52.204–YY, as prescribed 

at 4.403–7, to communicate 

requirements related to CUI should the 

contractor encounter suspected CUI 

during performance or the contract. 

(c) If the requiring activity states that 

there should be controlled access to the 

contents of the SF XXX or the SF XXX 

is marked as CUI itself, contracting 

officers shall follow agency procedures 


lotter on DSK11XQN23PROD with PROPOSALS4
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4293 

for safeguarding and disseminating the 

SF XXX. 

(d) If the contracting officer is notified 

or otherwise discovers that there is, or 

potentially could be CUI involved in the 

contract and it was not properly 

identified on an SF XXX, the 

contracting officer shall coordinate with 

the requiring activity to determine if the 

information is CUI. If the agency 

determines that the information is CUI, 

then the agency shall take the following 

steps: 

(1) If the agency wants the contractor 

to handle this kind of CUI during 

performance of the contract, the 

contracting officer shall— 

(i) Coordinate with the requiring 

activity to have the SF XXX updated; 

(ii) Modify the contract to incorporate 

the new SF XXX and, if CUI was not 

previously anticipated under the 

contract, to remove the clause at 

52.204–YY and incorporate the clause at 

52.204–XX; 

(iii) Consider any request for equitable 

adjustment submitted by the contractor, 

as appropriate; and 

(iv) Provide to the contractor marking 

instructions for the CUI. 

(2) If the agency does not want the 

contractor to handle this kind of CUI, 

the contracting officer shall coordinate 

with the requiring activity to address 

the CUI (e.g., retrieve the CUI) and shall 

convey such instructions to the 

contractor. 

(e) Contracting officers shall also refer 

to 3.104–4 for procedures related to the 

disclosure, protection, and marking of 

contractor proprietary business 

information, contractor bid or proposal 

information, and source selection 

information submitted to the 

Government. 

(f) The contracting officer shall follow 

agency procedures when providing any 

CUI to an offeror to ensure offeror 

compliance with the requirements in 32 

CFR part 2002. 

4.403–6 CUI incident reports. 

(a) Agencies shall protect against the 

improper use or release of information 

that includes contractor proprietary 

business information or contractorattributional information to the extent 

required by law. See paragraph (g)(9) of 

52.204–XX, Controlled Unclassified 

Information, for details on how 

contracting officers may use or share 

this information. 

(b) For CUI in a non-Federallycontrolled facility— 

(1) Designate the agency point of 

contact to whom the contractor reports 

a CUI incident in the SF XXX Part C, 

Section IV. When the SF XXX is not 

used in a contract, the point of contact 

is the contracting officer (see 52.204– 

YY(b)). 

(2) The SF XXX will list any special 

incident reporting requirements for CUI 

Specified. 

(3) Upon notification of a CUI 

incident, the contracting officer shall 

notify the requiring activity of the CUI 

incident as soon as practicable and in 

accordance with agency procedures. If 

the CUI incident occurs on an order 

against an indefinite delivery contract, 

the ordering agency contracting officer 

shall make the contracting officer for the 

indefinite delivery contract aware of the 

notification. 

(c) When the contractor is required to 

provide information system images 

preserved under the requirements of 

paragraph (g)(4) of the clause at 52.204– 

XX or as directed by the contracting 

officer in response to contractor 

notification under paragraph (b)(2) of 

the clause at 52.204–YY, in accordance 

with agency procedures, the contracting 

officer shall provide instructions to the 

contractor for submitting the system 

images. The contractor is required to 

hold the system images for 90 days 

unless the Government declines 

interest. 

(d)(1) The contracting officer shall not 

interpret a contractor’s report of a CUI 

incident to mean that the contractor or 

a subcontractor at any tier failed to 

provide adequate safeguards for CUI or 

otherwise failed to meet the 

requirements of the clause at 52.204– 

XX, without further analysis by the 

agency. 

(2) When a CUI incident is reported, 

the contracting officer shall consult with 

appropriate agency personnel (e.g., 

program office or requiring activity) 

before taking any action under the 

contract related to the CUI incident. 

When the contract includes the clause at 

52.204–XX, the contracting officer shall 

consider such CUI incidents in the 

context of an overall assessment of the 

contractor’s compliance with the 

requirements of the clause at 52.204– 

XX. 

(3) Unmarked or mismarked CUI is 

not considered a CUI incident unless 

the mismarking or lack of marking has 

resulted in the mishandling or improper 

dissemination of the information. The 

contracting officer shall consult with the 

appropriate agency personnel 

concerning any unmarked or mismarked 

CUI in accordance with agency 

procedures. 

4.403–7 Solicitation provision and 

contract clauses. 

(a) Insert the provision at 52.204– 

WW, Notice of Controlled Unclassified 

Information Requirements, in 

solicitations that contain the clause at 

52.204–XX or the clause at 52.204–YY. 

(b) Except for solicitations and 

contracts solely for the acquisition of 

COTS items, insert the clause at 52.204– 

XX, Controlled Unclassified 

Information, and include an SF XXX 

Controlled Unclassified Information 

(CUI) Requirements, in solicitations and 

contracts if the requiring activity has 

marked the ‘‘Yes’’ box in Part A of the 

SF XXX. 

(c) Insert the clause at 52.204–YY, 

Identifying and Reporting Information 

That Is Potentially Controlled 

Unclassified Information, in 

solicitations and contracts if the 

requiring activity has marked the ‘‘No’’ 

box in Part A of SF XXX, excluding 

solicitations and contracts solely for the 

acquisition of COTS items. 

■ 12. Revise section 4.404 and add 

sections 4.404–1 through 4.404–3 to 

read as follows: 

4.404 Basic Safeguarding of Covered 

Contractor Information Systems. 

4.404–1 Definitions. 

As used in section 4.404— 

Covered contractor information 

system means an information system 

owned or operated by a contractor on 

which the contractor processes, stores, 

or transmits covered Federal 

information. 

Covered Federal information means 

information provided by or created for 

the Government, when that information 

is other than— 

(1) Simple transactional information 

(such as that necessary to process 

payments); 

(2) Information already publicly 

released (such as on public websites), or 

marked for public release, by the 

Government; 

(3) Federally-funded basic and 

applied research in science, technology, 

and engineering at colleges, universities, 

and laboratories in accordance with 

National Security Decision Directive 

189; 

(4) Controlled unclassified 

information (CUI); or 

(5) Classified information. 

4.404–2 Applicability. 

(a) This section applies to all 

acquisitions, including acquisitions of 

commercial services or commercial 

products other than commercially 

available off-the-shelf (COTS) items, 

when a contractor’s information system 

may contain covered Federal 

information as part of performance on 

the contract. 

(b) While covered Federal information 

is not required to be marked or 

identified by the Government, some 


lotter on DSK11XQN23PROD with PROPOSALS4
4294 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 

administrative markings (e.g., draft, 

deliberative process, predecisional, not 

for public release) can indicate that the 

information is covered Federal 

information. 

4.404–3 Contract clause. 

Insert the clause at 52.204–21, Basic 

Safeguarding of Covered Contractor 

Information Systems, in solicitations 

and contracts excluding solicitations 

and contracts solely for the acquisition 

of— 

(a) COTS items; or 

(b) Federally-funded basic and 

applied research in science, technology, 

and engineering at colleges, universities, 

and laboratories in accordance with 

National Security Decision Directive 

189 when the agency does not provide 

any covered Federal information to the 

contractor. 

4.1301 [Amended] 

■ 13. Amend section 4.1301 by— 

■ a. Removing from paragraph (a) the 

phrases ‘‘PUB Number 201’’, and 

‘‘Federally-controlled information’’ and 

adding the phrases ‘‘201’’ and ‘‘Federal 

information’’ in their places, 

respectively. 

■ b. Removing from paragraph (b) the 

phrases ‘‘PUB 201’’, and ‘‘Federallycontrolled information’’ and adding the 

phrases ‘‘201’’ and ‘‘Federal 

information’’ in their places, 

respectively. 

4.1303 [Amended] 

■ 14. Amend section 4.1303 by 

removing the words ‘‘Federallycontrolled information’’ and adding 

‘‘Federal information’’ in its place. 

Subpart 4.19 [Removed and Reserved] 

■ 15. Remove and reserve subpart 4.19. 

PART 5—PUBLICIZING CONTRACT 

ACTIONS 

5.202 [Amended] 

■ 16. Amend section 5.202 in paragraph 

(a)(8) by removing the phrase 

‘‘proprietary information’’ and adding 

‘‘controlled unclassified information 

(e.g., general proprietary business 

information)’’ in its place. 

5.301 [Amended] 

■ 17. Amend section 5.301 in paragraph 

(b)(1) by removing the phrase 

‘‘proprietary information’’ and adding 

‘‘controlled unclassified information 

(e.g., general proprietary business 

information)’’ in its place. 

PART 7—ACQUISITION PLANNING 

■ 18. Amend section 7.103 by adding 

paragraph (z) to read as follows: 

7.103 Agency-head responsibilities. 

* * * * * 

(z) Ensuring agency planners—(1) 

Comply with the requirements of 

Executive Order 13556 of November 4, 

2010, as implemented at 32 CFR part 

2002 and in agency procedures, for 

controlled unclassified information 

(CUI). This does not apply to 

acquisitions for commercially available 

off-the-shelf items or for Federallyfunded basic and applied research in 

science, technology, and engineering at 

colleges, universities, and laboratories 

in accordance with National Security 

Decision Directive 189 when the agency 

does not provide any CUI to the 

contractor; and 

(2) Identify all categories of CUI in 

proposed acquisitions and incorporate 

them and accompanying CUI standards 

in requirements planning and the SF 

XXX, Controlled Unclassified 

Information (CUI) Requirements, as 

appropriate (see 4.403–4, 11.002(i), and 

39.105). 

* * * * * 

■ 19. Amend section 7.105 by— 

■ a. Removing from paragraph (b)(18)(i) 

the phrase ‘‘(see subpart 4.4)’’ and 

adding ‘‘(see 4.402)’’ in its place; 

■ b. Removing from paragraph 

(b)(18)(iii) the phrase ‘‘Federallycontrolled information’’ and adding 

‘‘Federal information’’ in its place; 

■ c. Revising paragraph (b)(18)(iv); and 

■ d. Adding paragraph (b)(18)(v). 

The revision and addition read as 

follows: 

7.105 Contents of written acquisition 

plans. 

* * * * * 

(b) * * * 

(18) * * * 

(iv) For acquisitions that may require 

covered Federal information to reside in 

or transit through contractor 

information systems, discuss 

compliance with 4.404. 

(v) For acquisitions that may require 

a contractor to have access to, create, 

collect, use, process, store, maintain, 

disseminate, disclose, or dispose of CUI, 

discuss the security, marking, training, 

incident reporting, and other 

requirements (e.g., destruction) 

applicable to CUI (see 4.403–5 and 

4.403–6). 

* * * * * 

■ 20. Amend section 7.503 by revising 

paragraph (d)(11) to read as follows: 

7.503 Policy. 

* * * * * 

(d) * * * 

(11) Contractors working in any 

situation that permits or might permit 

them to gain access to controlled 

unclassified information (CUI). See 

4.403. 

* * * * * 

PART 9—CONTRACTOR 

QUALIFICATIONS 

9.505 [Amended] 

■ 21. Amend section 9.505 by removing 

from paragraph (b)(1) the phrase 

‘‘Proprietary information’’ and adding 

the phrase ‘‘Contractor proprietary 

business information’’ in its place. 

■ 22. Amend section 9.505–4 by— 

■ a. Removing from paragraph (a) 

introductory text the phrase 

‘‘proprietary information from others’’ 

and adding ‘‘another contractor’s 

proprietary business information’’ in its 

place; and 

■ b. Revising paragraph (b). 

The revision reads as follows: 

9.505–4 Obtaining access to proprietary 

information. 

* * * * * 

(b) A contractor that gains access to 

another contractor’s proprietary 

business information in performing 

advisory and assistance services for the 

Government must agree with the other 

company to protect its information from 

unauthorized use or disclosure for as 

long as it remains proprietary and 

refrain from using the information for 

any purpose other than that for which 

it was furnished. The contracting officer 

shall obtain copies of these agreements 

and ensure that they are properly 

executed. 

* * * * * 

9.508 [Amended] 

■ 23. Amend section 9.508 by removing 

from paragraph (h) introductory text and 

paragraph (h)(1) the phrase ‘‘proprietary 

information’’ and adding ‘‘contractor 

proprietary business information’’ in 

their places, respectively. 

* * * * * 

PART 11—DESCRIBING AGENCY 

NEEDS 

■ 24. Amend section 11.002 by adding 

paragraph (i) to read as follows: 

11.002 Policy. 

* * * * * 

(i) When agencies acquire products 

and services subject to 32 CFR part 

2002, Controlled Unclassified 

Information (CUI) (see 4.403), the SF 

XXX, Controlled Unclassified 

Information (CUI) Requirements, must 

be incorporated in the contract and 

must identify, at a minimum— 

(1) The CUI the contractor will handle 

in performance of the contract; 


lotter on DSK11XQN23PROD with PROPOSALS4
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4295 

(2) Any CUI access and dissemination 

requirements placed on the contractor 

during performance of the contract; 

(3) Federal and non-Federal 

information systems the contractor will 

use to handle CUI in the performance of 

the contract; 

(4) System security and privacy 

requirements for each information 

system, as appropriate, and any 

additional security and privacy 

measures required by the agency; 

(5) Any instructions for handling CUI 

during performance of the contract; 

(6) Any CUI training requirements the 

contractor must adhere to in order to 

comply with 32 CFR 2002.30; and 

(7) Any CUI incident reporting 

instructions required by the agency, to 

include the agency website or single 

point of contact. 

PART 12—ACQUISITION OF 

COMMERCIAL PRODUCTS AND 

COMMERCIAL SERVICES 

■ 25. Amend section 12.202 by adding 

paragraph (f) to read as follows: 

12.202 Market research and description of 

agency need. 

* * * * * 

(f) Requirements documents for 

acquisitions involving controlled 

unclassified information (CUI) shall— 

(1) Comply with 32 CFR part 2002; 

and 

(2) Incorporate all applicable handling 

and compliance instructions included 

in the SF XXX, Controlled Unclassified 

Information (CUI) Requirements (see 

4.403 and 11.002(i)). 

■ 26. Amend section 12.301 by revising 

paragraph (d)(5) to read as follows: 

12.301 Solicitation provisions and 

contract clauses for the acquisition of 

commercial products and commercial 

services. 

* * * * * 

(d) * * * 

(5) Insert the clause at 52.204–21, 

Basic Safeguarding of Covered 

Contractor Information Systems, in 

solicitations and contracts (except 

solicitations and contracts solely for the 

acquisition of COTS items), as 

prescribed in 4.404–3. 

* * * * * 

PART 15—CONTRACTING BY 

NEGOTIATION 

15.407–1 [Amended] 

■ 27. Amend section 15.407–1 by 

removing from the introductory text of 

paragraph (f) the phrase ‘‘improper 

disclosure.’’ and adding ‘‘improper 

disclosure such as requirements for 

controlled unclassified information or 

classified information.’’ in its place. 

■ 28. Amend section 15.604 by— 

■ a. Removing from paragraph (a) 

introductory text the phrase 

‘‘proprietary information’’ and adding 

‘‘contractor proprietary business 

information’’ in its place; and 

■ b. Revising paragraph (a)(7). 

The revision reads as follows: 

15.604 Agency points of contact. 

* * * * * 

(a) * * * 

(7) Instructions for identifying and 

marking contractor proprietary business 

information so that it is protected and 

administrative markings conform to 

15.609. 

* * * * * 

15.606–2 [Amended] 

■ 29. Amend section 15.606–2 by 

removing from paragraph (a) 

introductory text the phrase ‘‘the 

legend’’ and adding ‘‘the administrative 

marking’’ in its place. 

■ 30. Amend section 15.609 by— 

■ a. Removing from paragraphs (a) and 

(b) the phrase ‘‘the following legend’’ 

and adding the phrase ‘‘the following 

administrative marking’’ in its place; 

■ b. Revising paragraph (c); 

■ c. Removing from paragraph (d) the 

phrase ‘‘clearly mark’’ and adding the 

phrase ‘‘clearly administratively mark’’ 

in its place; 

■ d. Removing from paragraph (e) the 

phrase ‘‘and privileged or confidential 

information to the Government’’ and 

adding ‘‘privileged or confidential 

information, or other controlled 

unclassified information’’ in its place; 

■ e. Revising paragraph (f); and 

■ f. Removing from paragraphs (g), (h) 

introductory text and (h)(1) the term 

‘‘legend’’ and adding ‘‘administrative 

marking’’ in its place. 

The revisions read as follows: 

15.609 Limited use of data. 

* * * * * 

(c) The agency point of contact shall 

return to the offeror any unsolicited 

proposal marked with an administrative 

marking different from that provided in 

paragraph (a) of this section. The return 

letter will state that the proposal cannot 

be considered because it is 

impracticable for the Government to 

comply with the administrative marking 

and that the agency will consider the 

proposal if it is resubmitted with the 

proper administrative marking. 

* * * * * 

(f) When an agency receives an 

unsolicited proposal without any 

restrictive administrative marking from 

an educational or nonprofit organization 

or institution, and an evaluation outside 

the Government is necessary, the agency 

point of contact shall— 

(1) Attach a cover sheet clearly 

marked with the administrative marking 

in paragraph (d) of this section; 

(2) Change the beginning of this 

administrative marking by deleting ‘‘All 

Government personnel’’ and adding 

‘‘All Government and non-Government 

personnel’’; and 

(3) Require any non-Government 

evaluator to agree in writing that data in 

the proposal will not be disclosed to 

others outside the Government. 

* * * * * 

PART 27—PATENTS, DATA AND 

COPYRIGHTS 

■ 31. Revise the heading of section 

27.203 to read as follows: 

27.203 Security requirements for patent 

applications and other patent information. 

* * * * * 

■ 32. Redesignate sections 27.203–1 and 

27.203–2 as sections 27.203–2 and 

27.203–3, and adding a new section 

27.203–1 to read as follows: 

27.203–1 Security requirements for 

controlled unclassified information. 

Contracts involving patent 

applications or other patent-related 

controlled unclassified information 

require safeguarding or dissemination 

controls that must be identified in the 

SF XXX, Controlled Unclassified 

Information (CUI) Requirements. See 

4.403. 

■ 33. Revise the heading of newly 

redesignated section 27.203–2 to read as 

follows: 

27.203–2 Security requirements for 

classified information. 

* * * * * 

PART 33—PROTESTS, DISPUTES, 

AND APPEALS 

■ 34. Amend section 33.104 by— 

■ a. Revising paragraph (a)(2); and 

■ b. Removing from paragraph (a)(5) 

introductory text the phrase 

‘‘development or commercial 

information’’ and adding ‘‘development, 

commercial information, or other 

controlled unclassified information’’ in 

its place. 

The revision reads as follows: 

33.104 Protests to GAO. 

* * * * * 

(a) * * * 

(2) Immediately after receipt of the 

GAO’s written notice that a protest has 

been filed, the agency shall give notice 

of the protest to the contractor if the 

award has been made, or, if no award 

has been made, to all parties who 

appear to have a reasonable prospect of 

receiving award if the protest is denied. 


lotter on DSK11XQN23PROD with PROPOSALS4
4296 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 

The agency shall furnish copies of the 

protest submissions to such parties with 

instructions to— 

(i) Communicate directly with the 

GAO; and 

(ii) Provide copies of any such 

communication to the agency and to 

other participating parties when they 

become known. However, if the 

protester has identified controlled 

unclassified information and requests a 

protective order, then the contracting 

officer shall obtain a redacted version 

from the protester to furnish to other 

interested parties, if one has not already 

been provided. 

* * * * * 

PART 42—CONTRACT 

ADMINISTRATION AND AUDIT 

SERVICES 

42.302 [Amended] 

■ 35. Amend section 42.302 by 

removing from paragraph (a)(21) the 

phrase ‘‘Subpart 4.4’’ and adding 

‘‘4.402’’ in its place. 

PART 52—SOLICITATION PROVISIONS 

AND CONTRACT CLAUSES 

■ 36. Amend section 52.204–2 by 

revising the section heading, the 

introductory text, the clause heading, 

and the date of the clause to read as 

follows: 

52.204–2 Security Requirements for 

Classified Information. 

As prescribed in 4.402–3(a), insert the 

following clause: 

Security Requirements for Classified 

Information (DATE) 

* * * * * 

■ 37. Amend section 52.204–9 by— 

■ a. Revising the date of the clause; 

■ b. Removing from paragraph (a) the 

phrase ‘‘(FIPS PUB) Number’’ and 

adding ‘‘(FIPS)’’ in its place; and 

■ c. Removing from paragraph (d) the 

phrase ‘‘Federally-controlled 

information’’ and adding ‘‘Federal 

information’’ in its place. 

The revision reads as follows: 

52.204–9 Personal Identity Verification of 

Contractor Personnel. 

* * * * * 

Personal Identity Verification of 

Contractor Personnel (DATE) 

* * * * * 

■ 38. Amend section 52.204–16 by— 

■ a. Revising the date of the clause; and 

■ b. Removing from paragraph (g) the 

phrase ‘‘Security Requirements’’ and 

adding ‘‘Security Requirements for 

Classified Information’’ in its place. 

The revision reads as follows: 

52.204–16 Commercial and Government 

Entity Code Reporting. 

* * * * * 

Commercial and Government Entity 

Code Reporting (DATE) 

* * * * * 

■ 39. Amend section 52.204–18 by— 

■ a. Revising the date of the clause; and 

■ b. Removing from paragraph (f) the 

phrase ‘‘Security Requirements’’ and 

adding ‘‘Security Requirements for 

Classified Information’’ in its place. 

The revision reads as follows: 

52.204–18 Commercial and Government 

Entity Code Maintenance. 

* * * * * 

Commercial and Government Entity 

Code Maintenance (DATE) 

* * * * * 

40. Amend section 52.204–21 by— 

■ a. Revising the introductory text and 

date of the clause; 

■ b. In paragraph (a): 

■ i. Revising the definition of ‘‘Covered 

contractor information system’’; 

■ ii. Adding in alphabetical order the 

definition for ‘‘Covered Federal 

information’’; 

■ iii. Removing the definition for 

‘‘Federal contract information’’; 

■ iv. Revising the definition of 

‘‘Information’’; 

■ c. Removing from paragraph (b)(1)(vii) 

the phrase ‘‘Federal Contract 

Information’’ and adding ‘‘covered 

Federal information’’ in its place. 

■ d. Removing from paragraph (b)(2) the 

phrase ‘‘controlled unclassified 

information (CUI)’’ and adding ‘‘CUI’’ in 

its place; 

■ e. Adding paragraph (b)(3); and 

■ f. Removing from paragraph (c) the 

phrase ‘‘Federal contract information’’ 

and adding ‘‘covered Federal 

information’’ in its place. 

The revisions and additions read as 

follows: 

52.204–21 Basic Safeguarding of Covered 

Contractor Information Systems. 

As prescribed in 4.404–3, insert the 

following clause: 

Basic Safeguarding of Covered 

Contractor Information Systems (DATE) 

(a) * * * 

Covered contractor information 

system means an information system 

owned or operated by a contractor on 

which the contractor processes, stores, 

or transmits covered Federal 

information. 

Covered Federal information means 

information provided by or created for 

the Government when that information 

is other than— 

(1) Simple transactional information 

(such as that necessary to process 

payments); 

(2) Information already publicly 

released (such as on public websites), or 

marked for public release, by the 

Government; 

(3) Federally-funded basic and 

applied research in science, technology, 

and engineering at colleges, universities, 

and laboratories in accordance with 

National Security Decision Directive 

189; 

(4) Controlled unclassified 

information (CUI); or 

(5) Classified information. 

Information means any 

communication or representation of 

knowledge such as facts, data, or 

opinions, in any medium or form, 

including textual, numerical, graphic, 

cartographic, narrative, electronic, or 

audiovisual forms (OMB Circular A– 

130, Managing Information as a 

Strategic Resource). 

* * * * * 

(b) * * * 

(3) Identification of covered Federal 

information. While covered Federal 

information is not required to be marked 

or identified by the Government, some 

administrative markings (e.g., draft, 

deliberative process, predecisional, not 

for public release) can indicate that the 

information is covered Federal 

information. If the Contractor is not sure 

whether specific information is covered 

Federal information, the Contractor can 

request clarification from the 

Contracting Officer. 

* * * * * 

■ 41. Add sections 52.204–WW, 52.204– 

XX, and 52.204–YY to read as follows: 

52.204–WW Notice of Controlled 

Unclassified Information Requirements. 

As prescribed in 4.403–7(a), insert the 

following provision: 

Notice of Controlled Unclassified 

Information Requirements (DATE) 

(a) Definitions. As used in this 

provision, contractor-attributional 

information, contractor bid or proposal 

information, controlled unclassified 

information (CUI), CUI incident, and 

handling have the meaning provided in 

the clause 52.204–XX, Controlled 

Unclassified Information. 

(b) Government-provided information. 

(1) The Offeror shall not use 

Government-provided information for 

its own purposes, whether or not the 

information is marked as CUI, unless 

the information is in the public domain, 

or unless the information was lawfully 

made available to the Offeror by 

someone other than the Government. 


lotter on DSK11XQN23PROD with PROPOSALS4
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4297 

(2) If Offerors require access to CUI, 

the Government will provide agency 

procedures on handling the CUI to 

ensure compliance with the 

requirements in 32 CFR part 2002. 

Offerors shall comply with these agency 

procedures when handling CUI. 

(c) Offeror-provided information. The 

Offeror shall appropriately identify 

information the Offeror owns and 

provides to the Government, which is 

contractor bid or proposal information, 

contractor-attributional information, or 

Offeror proprietary business 

information. The Government will 

determine in accordance with agency 

procedures whether the information 

provided by the Offeror is CUI or 

entitled to other protections (e.g., 

contractor-attributional information 

associated with a CUI incident). 

(d) Unmarked CUI or mismarked CUI. 

The Offeror should notify the 

Contracting Officer within 8 hours of 

discovery if the Offeror discovers any 

CUI that is not marked, not properly 

marked, not identified on the SF XXX, 

or is involved in a suspected or 

confirmed CUI incident. The Offeror 

should take action to appropriately 

safeguard any information the Offeror 

believes is CUI that is not identified in 

the SF XXX or is not marked or properly 

marked as required in the SF XXX until 

a Contracting Officer makes a 

determination. 

(End of provision) 

52.204–XX Controlled Unclassified 

Information. 

As prescribed in 4.403–7(b), insert the 

following clause: 

Controlled Unclassified Information 

(DATE) 

(a) Identifying controlled unclassified 

information. The SF XXX, Controlled 

Unclassified Information, that is 

incorporated into this contract identifies 

what controlled unclassified 

information (CUI) is involved in the 

contract. The Contractor is required to 

safeguard only the CUI that is identified 

in the SF XXX. However, see paragraph 

(c)(2) of this clause. 

(b) Definitions. As used in this 

clause— 

Adequate security means security 

protections commensurate with the risk 

of harm resulting from unauthorized 

access, use, disclosure, disruption, 

modification, or destruction of 

information. 

Contractor-attributional information 

means information that identifies the 

Contractor or its employees directly or 

identifies them indirectly by grouping 

information that can be traced back to 

the Contractor (e.g., program description 

or facility locations). 

Contractor bid or proposal 

information means any of the following 

information submitted to a Federal 

agency as part of or in connection with 

a bid or proposal to enter into a Federal 

agency procurement contract, if that 

information has not been previously 

made available to the public or 

disclosed publicly: 

(1) Cost or pricing data as defined by 

10 U.S.C. 3701(1), with respect to 

procurements subject to that section, 

and 41 U.S.C. 3501(a)(2), with respect to 

procurements subject to that section. 

(2) Indirect costs and direct labor 

rates. 

(3) Proprietary information about 

manufacturing processes, operations, or 

techniques marked by the Contractor in 

accordance with applicable law or 

regulation. 

(4) Information marked by the 

Contractor as ‘‘Contractor bid or 

proposal information’’ in accordance 

with applicable law or regulation. 

(5) Information marked in accordance 

with 52.215–1(e). 

Controlled unclassified information 

(CUI) means information that the 

Government creates or possesses, or that 

an entity creates or possesses for or on 

behalf of the Government, that a law, 

regulation, or Governmentwide policy 

requires or permits an agency to handle 

using safeguarding or dissemination 

controls. CUI does not include— 

(1) Classified information; 

(2) Covered Federal information; 

(3) Information a Contractor possesses 

and maintains in its own systems that 

did not come from, or was not created 

or possessed by or for, an executive 

branch agency or an entity acting for an 

agency (see 32 CFR 2002.4); or 

(4) Federally-funded basic and 

applied research in science, technology, 

and engineering at colleges, universities, 

and laboratories in accordance with 

National Security Decision Directive 

189. 

CUI Basic means the subset of CUI for 

which the authorizing law, regulation, 

or Governmentwide policy does not set 

out specific handling or dissemination 

controls. CUI Basic must be handled 

according to the uniform set of controls 

set forth in 32 CFR part 2002 and the 

CUI Registry. 

CUI categories means those types of 

information for which laws, regulations, 

or Governmentwide policies require or 

permit agencies to exercise safeguarding 

or dissemination controls, and which 

has been listed in the CUI Registry. 

CUI incident means improper access, 

use, disclosure, modification, or 

destruction of CUI, in any form or 

medium. 

CUI Registry means the online 

repository for all information, guidance, 

policy, and requirements on handling 

CUI. Among other information, the CUI 

Registry identifies all approved CUI 

categories and subcategories, provides 

general descriptions for each, identifies 

the basis for controls, establishes 

markings, and includes guidance on 

handling procedures (see https://

archives.gov/cui). 

CUI Specified means the subset of CUI 

for which the authorizing law, 

regulation, or Governmentwide policy 

contains specific handling controls that 

it requires or permits agencies to use 

and that differ from those for CUI Basic. 

The CUI Registry indicates which laws, 

regulations, and Governmentwide 

policies include such specific 

requirements. 

Federal information system means an 

information system (44 U.S.C. 3502(8)) 

used or operated by an agency, or by a 

contractor of an agency or by another 

organization, on behalf of an agency. 

Handling means any use of CUI, 

including but not limited to collecting, 

developing, receiving, transmitting, 

storing, marking, safeguarding, 

transporting, disseminating, re-using, 

and disposing of the information. 

Information means any 

communication or representation of 

knowledge such as facts, data, or 

opinions in any medium or form, 

including textual, numerical, graphic, 

cartographic, narrative, electronic, or 

audiovisual forms (see Office of 

Management and Budget (OMB) 

Circular No. A–130, Managing 

Information as a Strategic Resource). 

Information system means a discrete 

set of information resources organized 

for the collection, processing, 

maintenance, use, sharing, 

dissemination, or disposition of 

information (44 U.S.C. 3502(8)). 

Lawful Government purpose means 

any activity, mission, function, 

operation, or endeavor that the 

Government authorizes or recognizes as 

within the scope of its legal authorities 

or the legal authorities of non-executive 

branch entities such as state and local 

law enforcement. 

Limited dissemination control means 

any control identified on the CUI 

Registry that agencies may use to limit 

or specify CUI dissemination. 

On behalf of an agency means a 

Contractor uses or operates an 

information system or maintains or 

collects information for the purpose of 

processing, storing, or transmitting 

Federal information, and those activities 


lotter on DSK11XQN23PROD with PROPOSALS4
4298 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 

are not incidental to providing a service 

or product to the Government. 

(c) Identifying and reporting 

information the Contractor believes or 

has reason to know is potentially CUI. 

(1) The Contractor shall notify the 

Contracting Officer within 8 hours of 

discovery if— 

(i) The Contractor discovers any 

information that the Contractor believes 

is CUI that is not identified in the SF 

XXX or is not marked or properly 

marked as required in the SF XXX; or 

(ii) There is any inconsistency 

between this clause and an SF XXX 

incorporated into the contract. 

(2) The Contractor shall take action to 

appropriately safeguard any information 

the Contractor believes is CUI that is not 

identified in the SF XXX or is not 

marked or properly marked as required 

in the SF XXX until a Contracting 

Officer makes a determination. 

(3) If the Contractor discovers any 

information that the contractor believes 

is CUI that is not identified in the SF 

XXX that is involved in a suspected or 

confirmed CUI incident, the Contractor 

shall notify the Contracting Officer and 

comply with paragraph (g) of this 

clause. 

(4) The Contractor is not entitled to 

use Government-provided information 

for its own purposes, whether or not the 

information is marked as CUI, unless 

the information is in the public domain, 

or unless the information was lawfully 

made available to the Contractor by 

someone other than the Government. 

(5) The Contractor shall appropriately 

identify information the Contractor 

owns and provides to the Government 

(e.g., contractor bid or proposal 

information, contractor-attributional 

information, or contractor proprietary 

business information). The Government 

will determine in accordance with 

agency procedures whether the 

information provided by the Contractor 

is CUI or entitled to other protections 

(e.g., contractor-attributional 

information associated with a CUI 

incident). 

(d) Safeguarding CUI. 

(1) The Contractor shall safeguard CUI 

that the Government identifies in the SF 

XXX and ensure handling consistent 

with 32 CFR 2002.14. 

(i) This includes CUI that the 

Government provides to the Contractor 

or CUI that the Contractor collects, 

develops, receives, transmits, uses, 

handles, or stores in performance of the 

contract. 

(ii) For CUI located within a 

Federally-controlled facility, the 

Contractor shall follow agency CUI 

policies and shall ensure that any 

Contractor employees handling CUI 

within Federally-controlled facilities 

meet the prerequisites identified within 

Part B on the SF XXX for training and 

for access to CUI. 

(iii) For CUI located within a nonFederally-controlled facility, the 

Contractor shall follow CUI policies and 

shall ensure that any Contractor 

employees handling CUI within the 

non-Federally-controlled facility 

comply with the requirements identified 

in Part C of the SF XXX. 

(iv) Any applicable agency-specific 

policies for safeguarding or handling 

CUI will be identified in the SF XXX. 

(v) When information is not identified 

as CUI, it may be covered Federal 

information requiring information 

system security controls in accordance 

with Federal Acquisition Regulation 

clause 52.204–21, Basic Safeguarding of 

Covered Contractor Information 

Systems. 

(2) The Contractor shall permit access 

to CUI only as described in the SF XXX. 

(3) Except for its own information, the 

Contractor is not responsible for 

identifying or marking unmarked or 

mismarked CUI unless doing so is 

specifically included in the SF XXX, 

such as when the Contractor generates 

or develops the CUI. 

(4) No Contractor employee shall be 

permitted to have or retain access to, 

create, collect, use, process, store, 

maintain, disseminate, disclose, dispose 

of, or otherwise handle CUI unless the 

employee has completed training on 

properly handling CUI that, at a 

minimum, includes the elements 

required in the SF XXX. 

(5) Contractors operating information 

systems that access, use, process, store, 

maintain, or transmit CUI identified in 

the contract, shall implement the 

following requirements: 

(i) When the Contractor is operating 

an information system identified in the 

SF XXX as a Federal information 

system— 

(A) The Contractor shall comply with 

agency-identified security requirements 

from the latest version of National 

Institute of Standards and Technology 

(NIST) Special Publication (SP) 800–53 

and any CUI Specified requirements 

identified in the SF XXX; and 

(B) If using cloud computing services, 

the Contractor shall comply with 

agency-identified security requirements, 

but at no less than the Federal Risk and 

Authorization Management Program 

(FedRAMP) Moderate baseline (https:// 

www.fedramp.gov/documents/). 

(ii) When the Contractor is operating 

a non-Federal information system, the 

Contractor shall— 

(A) Comply with the security 

requirements of NIST SP 800–171 

Revision 2, ‘‘Protecting Controlled 

Unclassified Information in Non-Federal 

Information Systems and 

Organizations’’ (available via the 

internet at https://dx.doi.org/10.6028/ 

NIST.SP.800-171) or as authorized by 

the Contracting Officer. Additional 

controls other than NIST SP 800–171 

Revision 2 may be specified in the 

contract’s requirements document, in 

accordance with 32 CFR 2002.14(h)(2), 

to address unique requirements to 

protect CUI Basic at higher than the 

moderate confidentiality level; 

(B) Comply with all additional 

security requirements for CUI Specified 

identified by the agency in the SF XXX; 

(C) Implement additional information 

security requirements the Contractor 

reasonably determines necessary to 

provide adequate security in a dynamic 

environment; 

(D) Comply with any requirements 

from NIST SP 800–172, Enhanced 

Security Requirements for Protecting 

Controlled Unclassified Information, 

identified by the agency. For any 

requirements in NIST SP 800–172 

identified by the agency, the 

organizational defined parameters 

(ODP) provided in Attachment 1 of SF 

XXX shall be applied for applicable 

security requirements; 

(E) Ensure that, if the Contractor uses 

a cloud service provider to store, 

process, or transmit any CUI identified 

in SF XXX— 

(1) The cloud service provider meets 

security requirements established by the 

Government for the FedRAMP Moderate 

baseline (https://www.fedramp.gov/ 

documents/); and 

(2) The additional requirements in 

paragraphs (d)(5)(ii)(B) and (C), and (g) 

of this clause are met; and 

(F) Submit the system security plan, 

and any associated plans of action 

required by NIST SP 800–171, Revision 

2, for any planned implementations or 

mitigations to the Government upon 

request to demonstrate the Contractor’s 

implementation or planned 

implementation of the security 

requirements. 

(e) Compliance. 

(1) The Contracting Officer may 

require the submission of supporting 

documentation to verify compliance 

with the contract’s security 

requirements, or may require access to 

Contractor facilities or systems, as listed 

in SF XXX. 

(2) For applicable non-Federal 

information systems, the agency may 

conduct validation actions in 

accordance with NIST SP 800–171A, 

Assessing Security Requirements for 

Controlled Unclassified Information 

and, if applicable, NIST SP 800–172A, 


lotter on DSK11XQN23PROD with PROPOSALS4
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4299 

Assessing Enhanced Security 

Requirements for Controlled 

Unclassified Information. 

(f) Training. 

(1) General CUI training. All 

Contractor employees who will handle 

CUI shall complete general CUI training 

before doing so, and periodically 

complete refresher training thereafter, as 

described in the training sections at 

Section II of Part B and Section III of 

Part C of the SF XXX. The Contractor 

shall maintain documentation of 

employee training and shall provide it 

to the Contracting Officer upon request. 

(2) Additional training. 

Additional agency-specific training. 

Contractor employees shall also take 

any additional training described in the 

SF XXX sections on training. This 

additional training augments the general 

CUI training and may include 

specialized training for a particular 

category of CUI or for certain employees 

handling CUI in a specific situation, or 

other similar circumstances. 

(g) CUI incidents. 

(1) For CUI in a Federally-controlled 

facility, the Contractor shall report CUI 

incidents in accordance with agency 

policy. 

(2) For CUI in a non-Federallycontrolled facility, the Contractor shall 

report— 

(i) Any suspected or confirmed CUI 

incident to the agency website or single 

point of contact identified in Part C, 

Section IV of the SF XXX; if there is no 

point of contact identified there the 

Contractor should contact the 

Contracting Officer for instructions; 

(ii) Within 8 hours of discovery; and 

(iii) As many of the applicable data 

elements located at https://

dibnet.dod.mil/portal/intranet/ as are 

available in the initial report and 

provide any remaining applicable data 

elements as soon as they become 

available. 

(3) When the Contractor discovers a 

suspected or confirmed CUI incident, 

the Contractor shall— 

(i) Determine and inventory what CUI 

was or could have been improperly 

accessed, created, collected, used, 

processed, stored, maintained, 

disseminated, disclosed, or disposed of; 

(ii) Construct a timeline of user 

activity; 

(iii) Determine methods and 

techniques used to access CUI; and 

(iv) Cooperate and exchange 

information with agency officials, as 

determined necessary by the agency, in 

order to effectively report and manage a 

suspected or confirmed CUI incident. 

(4) If the suspected or confirmed CUI 

incident has occurred on an information 

system, preserve and protect images of 

all known affected information systems 

and all relevant monitoring and packet 

capture data until the Government 

declines interest or 90 days from the 

date of the submission of the report 

passes without the Government 

requesting the media and data, 

whichever is sooner. 

(5) Unmarked or mismarked CUI is 

not considered a CUI incident unless 

the mismarking or lack of marking has 

resulted in the mishandling or improper 

dissemination of the information. 

(6) If the Contractor is a FedRAMP 

authorized (Joint Authorization Board or 

Agency) cloud service provider, the 

Contractor shall also report to the 

point(s) of contact specified in the 

FedRAMP incident reporting guidelines 

as documented in the Cloud Service 

Provider Incident Response Plan. 

(7) The reporting requirements of this 

clause do not relieve the Contractor 

from the requirement to follow any 

applicable laws, regulations, or policies 

outside of this clause. 

(8) If the Contractor is determined to 

be at fault for a CUI incident (e.g., not 

safeguarding CUI in accordance with 

contract requirements), the Contractor 

may be financially liable for 

Government costs incurred in the course 

of the response and mitigation efforts in 

addition to any other damages at law or 

remedies available to the Government 

for noncompliance. 

(9)(i) The Government will protect 

contractor bid or proposal information, 

contractor proprietary business 

information, and contractorattributional information related to a 

CUI incident, against unauthorized use 

or release to the extent required by law. 

(ii) The agency may release outside 

the Government contractor bid or 

proposal information, contractor 

proprietary business information, and 

contractor-attributional information that 

is not created by or for the Government, 

but that is related to a CUI incident— 

(A) To entities with missions that may 

be affected by such information; 

(B) To entities that may be called 

upon to assist in the diagnosis, 

detection, or mitigation of CUI 

incidents; or 

(C) For national security purposes, 

including cyber situational awareness. 

(iii) The Government may use and 

release contractor bid or proposal 

information, contractor proprietary 

business information, and contractorattributional information, created by or 

for the Government and related to a CUI 

incident, outside of the Government for 

purposes and activities associated with 

responding to a CUI incident and for 

any other lawful Government purpose 

or activity. 

(iv) In any authorized release, the 

Government will minimize the 

contractor proprietary business 

information and contractor-attributional 

information that it includes. 

(10) An agency, at its sole discretion, 

may obtain assistance from Federal 

agencies or entities outside the 

Government, such as third-party firms 

to aid incident response activities. 

(11) The SF XXX will list in Part C, 

Section IV incident reporting 

requirements that differ from or are in 

addition to those in this clause, such as 

requirements for CUI in a CUI Specified 

category. 

(h) Subcontracts. 

(1) Except for the acquisitions in 

paragraph (h)(2), in subcontracts at any 

tier, or other contractual instruments, 

for which performance involves CUI 

identified in the SF XXX, Controlled 

Unclassified Information (CUI) 

Requirements, the Contractor shall— 

(i) Include this clause, including this 

paragraph (h), without alteration except 

to identify the parties; 

(ii) Include the information in the SF 

XXX, Controlled Unclassified 

Information (CUI) Requirements, 

modified as required to address the CUI 

that applies to the subcontract; and 

(iii) Require subcontractors to notify 

the prime Contractor or next higher tier 

subcontractor within 8 hours of 

discovery of a suspected or confirmed 

CUI incident. 

(2) Paragraph (h)(1) of this clause does 

not apply to acquisitions exclusively for 

commercially available off-the-shelf 

items or Federally-funded basic and 

applied research in science, technology, 

and engineering at colleges, universities, 

and laboratories in accordance with 

National Security Decision Directive 

189 when the Contractor does not 

provide any CUI to the subcontractor. 

(End of clause) 

52.204–YY Identifying and Reporting 

Information That Is Potentially Controlled 

Unclassified Information. 

As prescribed in 4.403–7(c), insert the 

following clause: 

Identifying and Reporting Information 

That is Potentially Controlled 

Unclassified Information (DATE) 

(a) Definitions. As used in this 

clause— 

Contractor-attributional information 

means information that identifies the 

Contractor or its employees directly or 

identifies them indirectly by grouping 

information that can be traced back to 

the Contractor (e.g., program description 

or facility locations). 

Contractor bid or proposal 

information means any of the following 


lotter on DSK11XQN23PROD with PROPOSALS4
4300 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 

information submitted to a Federal 

agency as part of or in connection with 

a bid or proposal to enter into a Federal 

agency procurement contract, if that 

information has not been previously 

made available to the public or 

disclosed publicly: 

(1) Cost or pricing data as defined by 

10 U.S.C. 3701(1), with respect to 

procurements subject to that section, 

and 41 U.S.C. 3501(a)(2), with respect to 

procurements subject to that section. 

(2) Indirect costs and direct labor 

rates. 

(3) Proprietary information about 

manufacturing processes, operations, or 

techniques marked by the Contractor in 

accordance with applicable law or 

regulation. 

(4) Information marked by the 

Contractor as ‘‘Contractor bid or 

proposal information’’ in accordance 

with applicable law or regulation. 

(5) Information marked in accordance 

with 52.215–1(e). 

Controlled unclassified information 

(CUI) means information that the 

Government creates or possesses, or that 

an entity creates or possesses for or on 

behalf of the Government, that a law, 

regulation, or Governmentwide policy 

requires or permits an agency to handle 

using safeguarding or dissemination 

controls. CUI does not include— 

(1) Classified information; 

(2) Covered Federal information; 

(3) Information a Contractor possesses 

and maintains in its own systems that 

did not come from, or was not created 

or possessed by or for, an executive 

branch agency or an entity acting for an 

agency (see 32 CFR 2002.4); or 

(4) Federally-funded basic and 

applied research in science, technology, 

and engineering at colleges, universities, 

and laboratories in accordance with 

National Security Decision Directive 

189. 

CUI incident means improper access, 

use, disclosure, modification, or 

destruction of CUI, in any form or 

medium. 

Information means any 

communication or representation of 

knowledge such as facts, data, or 

opinions in any medium or form, 

including textual, numerical, graphic, 

cartographic, narrative, electronic, or 

audiovisual forms (see Office of 

Management and Budget (OMB) 

Circular No. A–130, Managing 

Information as a Strategic Resource). 

Lawful Government purpose means 

any activity, mission, function, 

operation, or endeavor that the 

Government authorizes or recognizes as 

within the scope of its legal authorities 

or the legal authorities of non-executive 

branch entities such as state and local 

law enforcement. 

(b) Identifying and reporting 

information the contractor believes or 

has reason to know is potentially CUI. 

This contract does not identify CUI as 

being involved in the contract; 

nonetheless: 

(1) The Contractor shall notify the 

Contracting Officer within 8 hours of 

discovery if the Contractor discovers 

any information that the contractor 

believes, or has reason to know, is CUI. 

The potential unidentified CUI may be 

marked, unmarked, or improperly 

marked. The Contractor shall take action 

to appropriately safeguard any 

information the Contractor believes is 

CUI, until a Contracting Officer makes a 

determination. 

(2) If the Contractor discovers any 

information that the Contractor believes 

is CUI and it is involved in a suspected 

or confirmed CUI incident, the 

Contractor shall notify the Contracting 

Officer as outlined in paragraph (b)(1), 

determine and inventory what CUI was 

or could have been improperly 

accessed, created, collected, used, 

processed, stored, maintained, 

disseminated, disclosed, or disposed of 

as part of the incident, and follow any 

additional incident response 

requirements the Contracting Officer 

provides if the Government determines 

the information is CUI. 

(3) The reporting requirements of this 

clause do not relieve the Contractor 

from the requirement to follow any 

applicable laws, regulations, or policies 

outside of this clause. 

(c) Government-provided information. 

The Contractor is not entitled to use 

Government-provided information for 

its own purposes, whether or not the 

information is marked as CUI, unless 

the information is in the public domain, 

or unless the information was lawfully 

made available to the Contractor by 

someone other than the Government. 

(d) Contractor information. The 

Contractor shall appropriately identify 

information the Contractor owns and 

provides to the Government (i.e., 

contractor bid or proposal information, 

contractor-attributional information, or 

contractor proprietary business 

information). The Government will 

determine in accordance with agency 

procedures whether the information 

provided by the Contractor is CUI or 

entitled to other protections (e.g., 

contractor-attributional information 

associated with a CUI incident). 

(1) If it is CUI or entitled to other 

protections, the Government will 

protect against the improper use or 

release of the information to the extent 

required by law. 

(2) The agency may release outside 

the Government Contractor bid or 

proposal information, Contractor 

proprietary business information, and 

contractor-attributional information that 

is not created by or for the Government, 

but that is related to a CUI incident— 

(i) To entities with missions that may 

be affected by such information; 

(ii) To entities that may be called 

upon to assist in the diagnosis, 

detection, or mitigation of CUI 

incidents; or 

(iii) For national security purposes, 

including cyber situational awareness. 

(3) The Government may use and 

release Contractor bid or proposal 

information, Contractor proprietary 

business information, and contractorattributional information, created by or 

for the Government and related to a CUI 

incident, outside of the Government for 

purposes and activities associated with 

responding to a CUI incident and for 

any other lawful Government purpose 

or activity. 

(4) In any authorized release, the 

Government will include the Contractor 

proprietary business information or 

contractor-attributional information 

only to the extent necessary, as 

determined by the Government, to 

advance a lawful Government purpose 

or activity. 

(e) Subcontracts. The Contractor shall 

include this clause, including this 

paragraph (e) and without alteration 

except to identify the parties, in all 

subcontracts and other contractual 

instruments. The Contractor shall 

require subcontractors to notify the 

prime Contractor or next higher tier 

subcontractor within 8 hours of 

discovery of a suspected or confirmed 

CUI incident. 

(End of clause) 

■ 42. Amend section 52.212–5 by— 

■ a. Revising the date of the clause; 

■ b. Redesignating paragraphs (b)(12) 

through (65) as paragraphs (b)(14) 

through (67) and adding new paragraphs 

(b)(12) and (13); 

■ c. Redesignating paragraphs (e)(1)(viii) 

through (xxvii) as paragraphs (e)(1)(x) 

through (xxix) and adding new 

paragraphs (e)(1)(viii) and (ix); 

■ d. In Alternate II: 

■ i. Revising the date of the alternate; 

and 

■ ii. Redesignating paragraphs 

(e)(1)(ii)(H) through (Z) as paragraphs 

(e)(1)(ii)(J) through (BB); and 

■ iii. Adding new paragraphs (H) and 

(I). 

The revisions read as follows: 


lotter on DSK11XQN23PROD with PROPOSALS4
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4301 

52.212–5 Contract Terms and Conditions 

Required To Implement Statutes or 

Executive Orders—Commercial Products 

and Commercial Services. 

* * * * * 

Contract Terms and Conditions 

Required To Implement Statutes or 

Executive Orders—Commercial 

Products and Commercial Services 

(DATE) 

* * * * * 

(b) * * * 

(12) 52.204–XX, Controlled 

Unclassified Information (DATE) (E.O. 

13556). 

(13) 52.204–YY, Identifying and 

Reporting Information That Is 

Potentially Controlled Unclassified 

Information (DATE). 

* * * * * 

(e)(1) * * * 

(viii) 52.204–XX, Controlled 

Unclassified Information (DATE) (E.O. 

13556). 

(ix) 52.204–YY, Identifying and 

Reporting Information That Is 

Potentially Controlled Unclassified 

Information (DATE). 

* * * * * 

Alternate II (DATE) * * * 

(e)(1) * * * 

(ii) * * * 

(H) 52.204–XX, Controlled 

Unclassified Information (DATE) (E.O. 

13556). 

(I) 52.204–YY, Identifying and 

Reporting Information That Is 

Potentially Controlled Unclassified 

Information (DATE). 

■ 43. Amend section 52.213–4 by— 

■ a. Revising the date of the clause; 

■ b. Removing from paragraph (a)(2)(vii) 

‘‘NOV 2024’’ and adding ‘‘(DATE)’’ in 

its place; and 

■ c. Revising paragraph (b)(2)(i); 

■ d. Redesignating paragraphs (b)(2)(ii) 

through (v) as paragraphs (b)(2)(iv) 

through (vii); and 

e. Adding new paragraphs (b)(2)(ii) 

and (b)(2)(iii). 

The revisions and addition read as 

follows: 

52.213–4 Terms and Conditions— 

Simplified Acquisitions (Other Than 

Commercial Products and Commercial 

Services). 

* * * * * 

Terms and Conditions—Simplified 

Acquisitions (Other Than Commercial 

Products and Commercial Services) 

(DATE) 

(b) * * * 

(2) * * * 

(i) 52.204–21, Basic Safeguarding of 

Covered Contractor Information Systems 

(DATE) (Applies to solicitations and 

contracts, except acquisitions solely for 

commercially available off-the-shelf 

items or Federally-funded basic and 

applied research in science, technology, 

and engineering at colleges, universities, 

and laboratories in accordance with 

National Security Decision Directive 

189 when the agency does not provide 

any covered Federal information to the 

Contractor.) 

(ii) 52.204–XX, Controlled 

Unclassified Information (DATE) 

(Applies to solicitations and contracts, 

except acquisitions solely for 

commercially available off-the-shelf 

items). 

(iii) 52.204–YY, Identifying and 

Reporting Information That Is 

Potentially Controlled Unclassified 

Information (DATE). 

* * * * * 

52.227–10 [Amended] 

■ 44. Amend section 52.227–10 by 

removing from the introductory text the 

phrase ‘‘27.203–2’’ and adding ‘‘27.203– 

3’’ in its place. 

■ 45. Amend section 52.244–6 by— 

■ a. Revising the date of the clause; 

■ b. Removing from paragraph (c)(1)(v) 

‘‘NOV 2021’’ and ‘‘FAR clause 52.204– 

21’’ and adding ‘‘DATE’’ and ‘‘clause 

52.204–21’’ in their places, respectively; 

and 

■ c. Redesignating paragraphs (c)(1)(x) 

through (xxiv) as paragraphs (c)(1)(xii) 

through (xxvi) and adding new 

paragraphs (c)(1)(x) through (xi). 

The revision and additions reads as 

follows: 

52.244–6 Subcontracts for Commercial 

Products and Commercial Services. 

* * * * * 

Subcontracts for Commercial Products 

and Commercial Services (DATE) 

* * * * * 

(c)(1) * * * 

(x) 52.204–XX, Controlled 

Unclassified Information (DATE), if 

flow down is required in accordance 

with paragraph (e) of clause 52.204–XX. 

(xi) 52.204–YY, Identifying and 

Reporting Information That Is 

Potentially Controlled Unclassified 

Information (DATE), if flow down is 

required in accordance with paragraph 

(e) of clause 52.204–YY. 

* * * * * 

PART 53—FORMS 

■ 46. Revise the heading of section 

53.204 to read as follows: 

53.204 Administrative and information 

matters. 

* * * * * 

■ 47. Amend section 53.204–1 by— 

■ a. Revising the section heading; 

■ b. Removing from the introductory 

text the phrase ‘‘subpart 4.4’’ and 

adding ‘‘4.402’’ in its place; 

■ c. Removing from paragraph (a) the 

phrase ‘‘See 4.403 (c)(1).)’’ and adding 

‘‘See 4.402–2 (c)(1).)’’ in its place. 

The revision reads as follows: 

53.204–1 Safeguarding information and 

information systems (DD Form 254, DD 

Form 441). 

* * * * * 

■ 48. Add section 53.204–2 to read as 

follows: 

53.204–2 Controlled unclassified 

information (CUI) Requirements (SF XXX) 

SF XXX (DATE) Controlled 

Unclassified Information (CUI) 

Requirements. SF XXX is described in 

4.403 and 11.002(i). Except for 

solicitations and contracts solely for the 

acquisition of COTS items, the 

contracting officer shall insert the clause 

at 52.204–XX, Controlled Unclassified 

Information, and include an SF XXX 

Controlled Unclassified Information 

(CUI) Requirements, in solicitations and 

contracts if the requiring activity has 

marked the ‘‘Yes’’ box in Part A of the 

SF XXX. 

■ 49. Amend section 53.300 in the table 

following paragraph (a) by adding at the 

beginning of the table, the entry for ‘‘SF 

XXX Controlled Unclassified 

Information (CUI) Requirements’’ to 

read as follows: 

53.300 Listing of Standard, Optional, and 

Agency forms. 

* * * * * 

(a) * * * 

TABLE 53–1—FORMS IN THE GSA 

FORMS LIBRARY

Form No. Form title 

SF XXX Controlled Unclassified Information 

(CUI) Requirements. 

* * * * * 

* * * * * 

Note: The following form, Controlled 

Unclassified Information (CUI) 

Requirements, will not be published in the 

CFR. 

BILLING CODE 6820–EP–P 


lotter on DSK11XQN23PROD with PROPOSALS4
4302 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 


lotter on DSK11XQN23PROD with PROPOSALS4EP15JA25.033</GPH>

CONTROLLED UNCLASSIFIED INFORMATION {CUI) REQUIREMENTS 

&l&msiiedcutbyhie~(exceptfl>r_,_..,,,r,.;;;;:-,,, lllel&mmayl,b&iiakJ..,.llfJPIOPllate 

-filled out by Ille pnme <:OnirBclofJ. See Ille - atltle end of the lbm>. 

TbeContnu:t01"iaexpect,,dtoC-,devetop,....,ei't•flrimsmlt,-,-,...--cu1 __ _ 

mv- □- lf"Ye;t,•Fedemf~~ (FAR} clause SZ.204-XXappliU;tothePART B: CUI LOCATED WffHIN A fEOERAU. Y-CONTROU.ED FACILITY 

Thia-invowe&CUl-witllin •Fedenll!Y~facilily: 

ll;;lv .... □-

SECTION I: CUI HANOI..IIIG REQUIREMENTS ~-~ 

TbeConlnlelm"mustfollowagencyClli~im:!u<lil,g~-. andlleCUllty-reporting 

requiremenls. Tbeeontradormust-lhatanyCOn-employees~ CUI-F-...ily..eonlrolled 

fadlilie3 meetttie following pre,equisiles for aecessm CUJ. 00-~ -~ -~-? ~";:-;' -~-

{alGemmll~ 

The Conlraclormust"""""' all Conlmc!Dr~ m:~ or~ CUI in fll\lOCialionwill'I this cmlmct complele ini1iai general CUI tminmg ;,norm~ 

{i) For !raining~ ,equ11,,,,,,_s, ~-I 

(ii} Training_.,.,; {Select Contmctor, Agency, 

Tbe~--ttie.....-orttiefnmlng .. itlacooodm ====- - dewlopedbulil19lsse!ected. 

~ ~emp!oyees must complewrefresher~ 

{Seiect-,,ytl-. ,mnuaily, or - %years}~~;; <c:c:,;c-••'.cs 

f,v} Conlrador~wllohave ..-.-i genen,f CUl trainingwilllinlhe past1woyearsmr,ybeexemptftt>m 

-general CUI miining upon lliaflln!I - on lhls - A!l ll!ld apply""" checked. 

PAGE 

1 

Im Con!ral:!Drmay ..-lnfomlationon :pn,vi<>us ~anddatetoragency _..i. 

lE Employee maylalre•-m- 1Wl>ject. 

lE Employee may 1a1re rem,sner training ins1ea<i ot retaki!lg inili&l training. 

B Noexemptionwa1vera11owe<1. 

ST-DAROFORMXXXXXXIXXXX 

-t,yGSA-FAR{48CFR)~ 
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4303 


lotter on DSK11XQN23PROD with PROPOSALS4EP15JA25.034</GPH>

It>) OllleraddlllonalCUlfrelnlnglluequll!ed: ~Ya lfiljNo (SeeFARclllMH112.~} 

• CUI calegtxy-lll!d ltlldllng: 

PAGE 

2 

(A) ~n,quiledlDlllllenirling: 

(B) "lllle Of ,equlled llalnlng: 

(C) Tl'Ulillg llO!lfC9: (Select C!ffllra.dm: iUlin!:ll 

(0) Flequency Ofrelmlll,rnllmg: {Select ~. or eveiy2 ,._) 

(El Cmllador .... wllt!'-lllcelNdtllelllledfnlinqJ·lllilhlnthepll\lltwoyea19maybeexen,pllhlm 

lnllial IRlliling upon llillling-onllis conlnld. Allth!d app!y &1111 dlBcked. 

!ill Clli!l!1ICIDfmaysubmlin1Dm!llltanon llle~pievkMlllllnlnganddale•agei,q,appmql 

fil\! Emplope may tale lillntlD.._fmwJedgeoflhe llUlljecl 

f:lll Employlle may lllhMl!llherlrainlng illllleacf Of ndallng inililllfflllninll. 

t\1)Noexemplion--allaecl. 

STAtlOARO F<lM XXXX XXllCXXX 

F 

T 
4304 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 


lotter on DSK11XQN23PROD with PROPOSALS4EP15JA25.035</GPH>

PART C. Cl.II LOCATED WlTltlN A NON-FE0ERAl..lY-CONTROllE0 FACILITY 

This contract mvolY!'S Cl.II locate<! in a """-Fe<terally-eoatrolle<I facility: O Yea O No 

SECTION I. CUI HAH;OUNG Rl2QUIREMENTS 

!al CUI Compliance. 

{i) To v<!lify compliance wilh the seculiiy requirements, lbe agoocy Will: 

D Relliew documernation "" part of en ol!eror'!I ~ for evmuation dl.lring """""' $election. 

0 Review SUW<>rllng oocumentalion af!e< conlraof 11\llMI. 

O Reqμire '"'''""" tn offerer or con!ractor facl!itle& or systems to support -ncy valitlaliom> aclions. 

!iil Frequency or delailo ol document submissioo and O'leflligl\t actions: 

lb! CUI Basic. 

Thill contract ilMilves CUI Bsoie: 0 Yea O No 

If "No• Is dlecl«>d, proceed lo paragraph /C) of this "",;t/<;11 f<x CUI Specifi,;d requirements. 

(il The Coolrae!or elecis appropriate mefbods Ill ml!tel:.lhe CUI Basie lland!ing requirements fllr phyoiell! seeulii)' 

and --metoo<ls; mailing, ffll)roduction, andtrarismmiion methods; and~ methods m 

accootence willl the Code off e<tera! Regulations (CFR) at 32 CFR 2002, 14. 

PAGE 

3 

The CUI Basie involved in this oon!rad will be Mlldled ldenllc8l!y except for !he CUI Basie es~ 

iden-in~ (b)(iii of !llis sedion. 

If the "Access and dillsemlnation requirements• fill-in below is 'n/a," !hen all CUI Basie eslegones t.m, 

unique llandlmg requiremenls whi<ll are iden!lfie<I in paragraph ,l>)(li) ofll1m sedioo. 

(1) Access and dlssenlination reqμiren-ts: 

{2) lnfomlation systems and S)'Sle<n seeulii)' requirements. The CUI Basic will be oo ttie !ol'.owing 

s)'Slems: 

0 Fedeffll infumletion systen1(&) fcperate<I "on /JehBlf of an a(lef!Cy"}: 

D Non-federal inl<>rmalion s;"lrtem{s) (contnu:/:on, itlternBJ IT syslam). The Conlractor applies 

requiiemenfs from the National lllllliMe ofSlllmlards llnd Teclm<Mogy Special Publielllloo {NIST SP) 

81J0.171 ReviSKlll 2. (ff """'II clolJ<I. computing"'11Viees, see FAR c;.,,,,,., 52.2il4-XX(dl(fi/(i)(B).) 

0 Addilional controls are l!ll"cified ii'! ~ nc!iolll of llle requirements document in 

!he contract in aecoroance wl!h 32 CFR 2002.14(h){2). lo address requilements higl>ef lllan 

!he moderate eon~lify level. 

(3) Oeconlro!, retention, return irlslrueliom>: 

STANOARO FORM XXXX lOCIXXXX 
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4305 


lotter on DSK11XQN23PROD with PROPOSALS4EP15JA25.036</GPH>

PAGE 

4 

(lil The CUI Balll,: categories lillled bel0W have unique llllndlillg requlremenla QS lndicale<I lllr Mell 

eatego,y !Isled. 

If Ille 'CUI Baie eateg0ry name and marldng" flll.in belOw is "Illa,• then there 111"11 llO CUI Basic 

eategoiin lhlll have uniqua lllll1dlillg requiremenm. 

• CUI Baaic clllegoly name md marking: 

(BJ lnftlmlalion 

srste,m;I: 

~ and syslam ui:mily ~ 

Cl flldenll inlbm,atioo 'aysleffl(sJ (opetat&d 'bl! be/mlf of en ""611CY'' 

CJ Additional conlrols are specffit,d in (> }-'~~ti\) of Ute requi!llmlmlf. documant in 11111 contmct in lilCCOl'dance wlth 32 CFR 2002 .. 14(1,)(2), to ll<ldreu requiremems higher tllan 

hi modetate conlidMIIIIIII~ l!ml. 

STANDARD FORM XXXX lOOXXXX 
4306 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 


lotter on DSK11XQN23PROD with PROPOSALS4EP15JA25.037</GPH>

le} CU!Spedlled 

5 

Tm-in-CUI Speeili!ld: CJ Ytt O No 

F~an,,t,e~c!Ctl!Speci!le<l-ll-.eirS!)l!ci!le<lll>mdiin!l~nts: 

" CUJ Spe-.i ~namearu:lmlll!oo!!: 

(E) Limlle<l~wmrol-;,,g,,(LOCM}: 

{F) Mdin!l liM-reQUiremeffl!I: 

{1)Tl1e CUI ~w lie°" Im~~: 

LJ Fweral~ ~;oj {_,..11,d"ll,i bet,alf f)f ;,n ~"): 

STAHOARD FOOM XXXX lOOXXXX 
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4307 


lotter on DSK11XQN23PROD with PROPOSALS4EP15JA25.038</GPH>

!IF£JION I CQNJJMCIQR P!B!ON5 SfA!PR!'MfKIS 

tllltCCllllradorwlll lJe ~ fOr flM1111m9CUl ldellfflledili~ I; m Yn lliJ No 

NYN,t:1111q;fywilhtbe lbllow#lg--~ 

PAGE 

I 

(BJ AnvNqlnd.ad!IIIIOn!II CUI~~~ lRGWP: 

STANDARD .FORM XUX XlCIXXlCX 
4308 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 


lotter on DSK11XQN23PROD with PROPOSALS4EP15JA25.039</GPH>

SfCTJOH 81- DMfllG ffl;QtllQfMEffII 

(a) Gelleral~. 

The ~muat~all ~ "'1lp!oyee8 ~ or~ CUI In UlliOCialion will! 11!111 conllaCI 

eomplelelllilialgenll!a!CUl1rain!ng priorlo ~ CUt 

(I) For1nlining~~ -FAR cliKffll 5221l4.xxtl), 

(ii} Tm11,mg,11111m:11: {SelelltCOl-lllt,,'llilflCl'OI 

The COnlm'l!lr - mnlrattor~ 

(ii) ~~.-COllllllefeftll're9l!llf!lainilg: 

(Seledellery 6 mcrnhs, almlllllly, oreve,y 2yeer&J (," ,,,;;;;;,;;;;,;:;Jo:c.i;Xh-,:J:;-:;:h;;Ji 

!lvl C<llllraderempil>yeeswhohallil N!CIIMld!l'lffllllllCUI lrainingwilh!nlhepaattwoyema.maylie exempt limn 

ll'.liliel ~ CUI 1nm1ng upon fflflinllworlonlllil>cootract. Aff lhatapplyare checliell. 

~ Coolnu:!or may llllllnll ~ (1ft 'IMIIIQJll<lyee'll, l)Rl'llwo lrainin!I and dllle - ~ appmvai.. 

g,J EmptQyee may!llle e lftt toalmw lmow!edgeof lheMl>jel)t. 

flr;J Emp1Qyeem,ay!llleR1111~rtmini!lgillal< fnll!ng.inilllltnllnillg. 

~ No exemplion ~ all!l'nd. 

(I>) otberaddlllomd CUI~ ill required: [;l Yea Iii.!! tto jSee FAR~ 52.~J 

• CUI celegOly name and ffllllk!ng; 

PAGI; 

7 

!Dl oreve,y2ve-} ,(t,(\c);'\ 'i>/tl 

iE} lhe paat two yu,a m,ayJ>e exeml)tlmln 

intlallnlilmg uponslatlingwollt on!lnconllaCI. A11·1hatapp1yere ellel::ked. 

l]lJ Conlraetor ITIIIY~ fnf<lnmlflonon11le ~'a Pl'IIV!OUll lrainingel'ldffllle lilr;agency IIIIJIIIIMII, 

!lli1 E~maylilkealfttlo-!molrledgeoflhellUl:ljecl 

~ Employee may take llffl!8ilefli'Um!i illslud Offfllning !nililll tnllnillg. 

~ No~waiver alloftd. 

STAIIOARO FORM .XXXXJOOUXX 
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4309 


lotter on DSK11XQN23PROD with PROPOSALS4EP15JA25.040</GPH>

IECJJ9N IV CUI IIIQQFtfT BfP9BDHG RfQIMBENfNIS 

{a)fhll0dlll8. 

Tbe Contractar ill nJqllired 1o fllPCll1 aft CUI inc:idell1-1rr.· 

(II) Reportill&lequ!rlillfflla. 

(I) Anyautpeellldor~ CUln:idenlffllllll!Kt~Wlhln.l.ll!!lniif~, 

(ii) SeeFARcfalil!l~foralreportlng~. 

(c) CUISpedlfed ~ ~ 

11le l'Ollawing-lilr reporting iif CUI .Spedlled lncideftlll:. 

• CUI Speclied ~anrlnaldng: 

(A) CUI lm:ldel!treportlng,equlremenlalhal dllferll'amar818 lll addlllan to U-IRFAR daule 

52.21)1.J(X{g). 

TheCclnlracliarfflUll ~ wilh ~ ll'am NIST SP 8111).1n, El'lllllnced Seculily RequiNmllnill Jar PnllllcltlQ 

cut, idel!lilled lly ... agency. 

IJlllY" m}No 

lfyw. lhe agencydidlln!il,~for NISTSP 8QO.f12Gllliide ariiiia riiml.. 1lie. C319m1li!lllla1111ldefifflld. 

~(ODP)ln~ 1 Dftllis SFwllbe.,.,,aA..., appllcallleWUlly,...-ldllnlllledllyltle . 

STANDARD FORM XXXX XX/lOOIX. 

PAGE 

8 

F 

T 
4310 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 


lotter on DSK11XQN23PROD with PROPOSALS4EP15JA25.041</GPH>

IMSTIWCTIONS 

ilD!lml 

1, Wllo fills out the form? 

1h1ulepammmllagenqt1IIIHutlheflllm, 

~ 

notllleCOll!rador. If a lllriraclarwilllnlo!IWlhe loml lo C01M1J 

lo a ...-ctor, Ille comm:larmay 1111101' ll!e~ a epproplialll 800 fill Oil! lllefannfilrlhe 

11Ubetm1rao1Dr. D 

l. Wlwt ill con1mlled undauffled lnfamation (CUii? 

CUI is inlofmallllfl lhatmusl not be public (see lhe dl!linilionat Ille FederalAcquilllion RegUlatlon (FAR:! 2.101). far 

infOmtatim llbollt CUI, CUI Basic, CUI spedlled, and the CUI Regislly, - FAR 4.403 and 52.2114-XX. and lie Nllllonal 

Ard>ives, and Record& Admillillllaliml (NARA) regulali<lllli al the Code of Federal Regulalio1111 (CFR) lit 32. CFR part 2ll02. 

An exaffl!)le ol CUI iiS "conlraaor proprielaly busln""" __._ 

PART A. APPUC/\BlliTYOF CUI REQUIREMEf(TS 

0oee Ille solk:ilalllln Ill" conlnN:t imolft CUI • II 

!11111 file cooln!lcl<:v ,_,,.CUI, or~or 

If no, !he connct will not ffilllWII CUI, lhen tlleCk "No'. Slophera. 'lbe..-er ofllle farm wffl lmlllftblml. FAR 

dlnme 52.204-YV, ldenlllylng and Repacling lnfllmlllllon That ill Pall!ntlally CGnll1ltled Unclllssllied lnfonMlion, wil be 

Ulled in aollcillll!l:lml and cnaclll .._lllilllillm ind!eales "No." 

lfJll8, lhe conlrlll'twlll inWl!we CUI, lhen dlecll "Yes" and complell!I lllefannwhllreappllcallle lilr yoursoticllallanor 

con!lact. FAR clawle 52.204,XX. Conln:llled l.lllclallsilled lnfomlallcln, will be used in flOlk:llations and comradll when tis 

folm indicate,! "Yn.• 

PART B. CUI LOCATED WITKIN A ~l Y-CONTROUEO f AC:lllTY 

- lhill eontrllct ffl'l<llve CUI--a Fede1'1111y-controlled f8cilitJ? 

If no, lhe CUI "' NOT localed wllmn a ~rolle<I fllcililY, fmlrl clled< '"No" and JIIOCIIOO lo l"Wt C. 

lfyn, bin ci!e<:k "Yflff' and-,,plele lllctloml land fl Ill Part 8. 

SECJl9N ,, cm ffJ\NDl.lNA f!f9WPfMfffIS 

lflhe con!raet imloMlaCUlfhlllrequhscanlral:lllrempklyeeslDmeetcatutpnm,qulslles lle!bre llelngaa-dm accau lbe cu,, lhe . .-,.mutidemly hi: • in Ille lill.fn 11111d. 1h11 c:onmmor muat enue Ila 

tlll1PIOYee• who w111 neec1-1o llle.in· mnalla, 

S!ldl pmequllilM 111"1' aiillll flonl an IIJlllll)Ved conlrol ll!lll'lllllg (UlCM) lillled 01! tlle CUI Regially 

orfmm a CUI Specifieddlmllyand mar inclu<le LOCMsorlnftll -Oowemmlmt JIIIIPOSII (LGP) Rlllllriellons that•~ 

mU1lt meet in ol:llef lDaccesa Ille CUI. 

Examples; (I) For .. ~~ CUl11lalllo II 00 li:)reigfl .-...'NOFORw limiled dios- oonlroi, the 

agency might ~~hamlling {ca!egoly olf CU!J-lllis coo!rad:muslnotbe foreign lllfflOflall'. (2} For a 

tllldllll:I ilWl>lmg CUI ~am,go,ySP.cvTI, tile agencymigll!-~ ffl!ISl have anatioolllsecurily_ 

b8t:l<groffl!l in~ .• 

elc,·lttal 

Tilildon 

involve 

not indvdBg!lffl!fal 

•c-fll agency~ 

~ 

ingemmil or kl 

PAGE 

9 

STANDAIID FORM XXl!X xil'ooooi: 
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4311 


lotter on DSK11XQN23PROD with PROPOSALS4EP15JA25.042</GPH>

SECTION p. JBAIIING REQUJREIIElffS, 

!al Plmride..--CUllr1liMISlad'llnmllion. 

(I) All ClllllfaclDrempiaJIIM-llllcegenen,l CIJllnlillin!I priarlD_.. CUI. TheyfflntlllSOcomplela 

.ialleollterlralnillg nallllnolll!nlhan-ewrytwo yea,s. 

(ii) klllnlilylhe-lilrlhe genen,l CUI tnma,g {I.e., contradm'ff!IIYdmllopilllOllllft lnlinlng, CQftllaclarmulltuae 

ageney1nliulg, or CCllllnlelllrmay-llailling bylllinl partlea). 

(ill) ~hm111e dnlp-clawn Ille~ IMling (le~ ~6mantha, ~. cir em¥ 

2_.:,. 

{ill) lfllleagenq,d affllWCD1'11111doTemployeelitobeuamptlmm lhe ~b"illlilllgenllfal CUllnlillin!I 

wllen "8y tim, lllceived 1Uch lnlinlng ill •1Jl1MOUlliGb, check lheeppficablltmelbada llla agency will..._ 

CllllbaclDr~IDuse(l.e~-lllbmlemployeelralnillgdalllill,employeelNting,orRlh8la'lnlilling)1D 

cll!llnanslmmpmllclency. lflbe eump11o11...i-1s not allond, cl1eck lhe 111111 box. 

Cb} PnJ¥ide other addillonel CUI tnllllinD illfonmlf.loft. 

lf1he agencyfllllllilnt111111e or aB car,nclaremplDyees ID!llte addillonlll-lnlfnlllg1n~ will> FAR 52.204-

XX{l)(2l(I). checll "Yer/" end Cllll1jllelelhe infol'maliQQ. ~ are IIOeddillamlllnlilllng reqm,menla, chedl. "No." 

Enlerllle CUI calllgaly-end IWldng lhatn,q.,lrs~:::11 llaining lnlbellll-al field. 

{A) EnlerlhetfflllP r#canlnlclelremployeea 11111D auttllle llw1nlnillgby lille, Ille olllce1heydWlllt In, orolller 

idenllllolr. 

(B) En!llrlhe1111edlheaddiliGnaluaiM,gllley-1aloo. 

(C) Sllllld ll!enilling -tam Ille dnlp-down forlhe addillonllllnlillin!I (i.e., conlnldormarde\llllop illlOllllft 

lnlinlng, COldnlclDr 11111111 uae 911111'1C)'!nilil!ill!I. or conll1ldar may -lraitling de¥elDp!ld by thin! parlm). 

(0) Sdecthmlhednlp-clawnbaxlle~wilhwl1idlcontmlar~musl-llds.-ial 

fnllnlng. 

(El If Ille agencywlll allaw CllnlnlClm ~ to be • 

lie mel!IDda llie agencyWillelkNrClllllrlll:IDr 

appropna1e llo.X(es) {l.e~ llllnltemployee 

~lionWlliwlrlsl1Dlallolled,dlllCklhelastbax. 

from Ille lnllial additional tnllnillg requinlment, ldeRl1ly 

- lD dml1a11--pioliciltnq by Cheding tlle 

, llffllllO,eltlnling, arn!li'alherlralnillg). If"" 

U.. lie •Add AddWana!Tlllinlng" bu\lQnlD aeale an emryfQreacll CUlcalegoly. 

PARTC. CUll.OCATEDwmtDIAIIOIUB>£RAU.Y-eoemrou.E01'ACIUTY 

Will llllll canrract 1nva1ve CUI loCllled Wllllln a IIOIH'~ facillly? 

If no. the CUI ill NOT localedwlhln_ a ~facillly, !hen cl1ecll "No". SIDphllre; ll!e 1111Ui1mg eedionaln PaltC will nal 1111 applil:ablll. 

lfJW, lhen checl! "Yl/llll'lllldCCl!llpkl!loNClillrlSlllnuugb . 

KCJION 1. cw IIANllUffli:Bf9WBFIIFNTJ 

(II) ldelllllywlllcbllllltllad(alWlllbelMdto-itlrnmpl111ca Dell!rmlnllwlticllmelhod(a)ll!eegllllcy'willUNIII 

~ Ille amlntclar ill camplylng wll'I h Cllldnlcl'S IIIICUll.y noquhmauta. 

{I) Cliedl-wmcnGflhelloxeslhatapplyal(al(i)"Tow.WymmpliancawilltlheMCU!ily~h 

ageneywil.' 

(II) Ulin!Jlhe liMl lleld underpanignlph(a)(II}, enlilr~(81111111111y, ewryllix IIIOlllha, ell:.llhe conlntclarllilll need louimit~ documetllB, lhe detailaof IIUllmlnian,, and lhe-ol lMDl!lllt llCiirffl lite 

agency d engage ill. 

PAQE 

10 

STANOARO FORII XXXX XXIXlOOl 

EP15JA25.043</GPH>lotter on DSK11XQN23PROD with PROPOSALS4

... J 

~-

. D I 

11,i ii HIH11mum11. U'1 l!Hlf i 1 i! il!J! 

j } .n,, M u jl 1111! I 2i hifo I ;.~ n~ 

,rl .. , iaf g 1'• rtsr·11 fl 1illl!F.,. .. 

... ' 1,r ft u11(. sl HU 

,1

1• ruu -i.tHH

1i!i 1 .1 Uhl I u 1

1H

11 lmr 111 1M n 

1t fffii ii 'i 

ti •ith 1'!1 If tll'll' I t''' I; !I· ,~ t 

•'t• r i" .I j ,r. "i 

rl f 1111 11! tl rJ

1

1i i I 11111 (i 1=, 

'I ;J,U l; ll , •. : i'j l.i· ., iU 

i 1 f' Ir I . I r f i It Ii. , I ls. • !' ·!'1. !! 111} u 11p1 

1

1! n.1

I •• 

n1 H jq P !! 11 h I '!; 

EP15JA25.044</GPH>lotter on DSK11XQN23PROD with PROPOSALS4

."\:. 0;::."~:~-~~~·.,,.·~.- .'·•~~~'•. ·:' :.-·_-., _ _- ·: ··,' ··,,.·,,-,.,.,.,'·-~•,,,~··,.,~.,_,.-.,.,~; .,,, • .,_.,,....,,..·~0.'.c;'.1/,,.

;:=I I ii 51 li! ! !! !! .if 

Hl

11 II ilil 11 f ll I llllil

11 Ill! U I 

_ 

I ! · f 11 · Er It l i I,. · I I "- 

Ulf· ~11 J 11

1

11 i.,, h i! hf I n!I I bf 

§ I rr, ,. J f •i JI f''1 111~ f'1 

1111 ii 

h1l1B 11 u 11h :1d 111 

I 

2Hi ,~ t IP i I; 

1

11 1 ti mt ii 

1

11n1 it i uh 11 

j1 1 u fHi H 

·i· . ·1 IJ: ·~fl f ri ra.1 ,j i a 

• fl!I' . i i I aa 

• ii! . S'l>i 

;.;:. : , .<<·:-.- , ·,=.,··:>:.·· --:;: _;:·· ;-..-: ,_::-_, ;,·,·. :.: (;·.·:·:_:.·-.:.,·. '.;-'.• -::·-'; ·,._.,_.:.-.: ::-:.•.:·,•,; ;,.'.·.: ,··;:.-:-::::t',-:.-.::--_;1~= ,-,,·,-•::· .. : .-.·;_,_,_.-: :: ... ,_:::.-_'::.~ r·.-::' _,._,= .:-:.:·:',',=.: 
4314 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 


lotter on DSK11XQN23PROD with PROPOSALS4EP15JA25.045</GPH>

{It lleslruction: lnclllde arry ~ for deslruclloo coolained ii> !he appliCable LRGW!>. 

(.I} Decomrol, retention, return_, ldenlify calegmy..opecilie-forhandli!lgthe CUI Spetilied 

cat,,go,y. lfi!hasa"del!lroyl>y"-,idenfify~ci!ic-dec--lha!apply- -llle--dolnllie_,_ ___ Alfy-~-!he 

-will-!heCUlorrel:um itlo!he-(ei!herdulingllie.,.,.._orupon-). i,y-, 

1lill whatmelhod, elc. lm:iitld<'1my LIRG1ffl>reciluin focdel:onlro!, -,er relum. lnslrudions may also 

induderecon!a"""-"""'!nslruefiof1sand. forlramremngCUllo!he-Arcl!ive$. 

Use l!le 'Alld Speeilled ~-lo creaie each CUI Specified calegory. 

SECTION II. CONTRACTOR MARKING RF9!00fUFHI§ 

Wlll ffle oontrador be""'IIOft!libf for~ tlle CUI identified in aection 11 

lf m, !he -Will notbe--formalling!he CUL Ched< "No" and proceed lo section ffl. 

lfyea, !he-will be ~forfTlllllml!llheCUl, 11lenched< "Yes"lo"Collh<:IOrwillbe ~for 

ll. 

in !Ile "CUI calegory -- calego,y msmng" !ill-in-. ~must be pall:2002, theCUIRegisllyat 

bllps1fwwW.an:ltives.qov/CUl. amllbeCUI Maning-_ lfllle-willbe mallingall ~-

msrling lhem all!he same way, enter "All CUI~ lnseciion t • The infDrmalilln for Ille CUI call!golywilneeif 

lo lie entered in~ (A)and (8). 

IA) Applicable Limited ~Control Marl<inp{U)CMsl from tlle CUI Rqislly: Ustinlllefill-infield 

arry applicable UJCM !he -will lie required lo apply lo the catego,y. 

(8) Any,equired ,...._CUI Specified markings from-, regulation. or Govemmenlwkfe Policy 

ILRGWP): Ustinlllefill-infield-addition81 maikil1gs requmf by l.RGWPlll&I the-Will be required 

to app!y In Ille mlegmy. These may. • -india!il<nlf1he l.RGWP requlJes !hem. 

Usellle"MdCalega!y"bul!oltlo-anenllyfor lcalegorywilbmail<ing~ 

SECTION Ill. TRAINING REQlllREMEffTS, 

(al Provide.-training information. 

ro A11-emp1oyees must-genera1 CUI lrainil!!I pr;or1nac-.ng cut n,eymus1:a1so ,:omp1e1e 

ni!rellherlrainilgoot!essollenlllanooceeve,ytwo_,.. 

(ii) ldenlily !he_...,,, for !he general CUI lmlning (Le., --~ilsownlraining, --- -training, or-mayU11e~<leVe!Dped l>ylhiniparliea). 

(iii} Seleetfmmllledmp-down!he~fretl<H>""![Wrel!-esf,erilrairling!(ie.,!M'lfYS-,IIMUlli!ycreve,y 

2yeano}. 

(w) lflhe~will--~ll>beexemptfmm.-gene,al CUffnlini!lgif!heyl!ave~ 

training ina previous job, ched< !he applicable melllods llie agencywlll--employees lo use(ie, 

-employee !raining <lelail!l, employeetesling, or ni!rellher!ralning}. lfllleeJ«!ltll)liDn-isootallowed, 

ched<lhe---

(bJ Provide-additional CUltrailliRg ~ 

lflhe-reqwessomeorall-employeellmfllkeaddiliooallralningin m:t<lltiancewill>FAR52.204-XX(!)(2)(0, - "Yes"and ""'1!plele the infofmalioll. lflller,o are noaddilionlll training._-, -

::::::::..~u:::i,requin,dl>)'FAR-¥4"3 for-~-$hould ootbeldenlified 

Enler II CUI mtegmy name and marking 111111 require& ..Li....athinillg in lhe fill-in field. 

£Al Enlerlhe gmupot-emp1oyees wllo-take llle lmlningllytille. ttteofflcelhey will-ln, orolfler 

...-. {BJ Enlerlhe - of !he addlliomll nlning !hey must-. 

{C) Select llle-..g source from Ille drop-down for llle -lfaining il.e., <:oolra<lonnay <leYe!op 11s own fraining,-numine~!raining, oonlnldormay ine lniiningdeveloped t,ytir<lpames). 

PAGE STANOARO FORM XXXX XlUXXXX 

13 
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4315 


lotter on DSK11XQN23PROD with PROPOSALS4EP15JA25.046</GPH>

(D) Sele<:!: from !he dro;xlown bo• !he frequency with wll!ch Ille cmlractm emj>l<!ye""' mui! m-e lm!I addiliomll 

trmng, 

SECTION IY CtlJ !NCIOENT Rfl'ORTING REOOIREMENU 

(a) Repmti119, 

\/\'lien !he CUI io\llllved ls toealeQ al a noo.fedemlly,coolrolled fllcillly, !he -dot wiW repoo affi inoidenb M 

idenlifll!d in Ille filj,,ifl field. 

PART 0,, APPLICABIUTY OF NIST SP t!OIM72 

Does the conlraomr have to comply willl any re.quirements in NIST !IP II00..112? 

It no, !he CUI will NOT roquire compliarn:e wilh "nyrequirement" of NIST SP 500-'172, lllll!H:heck 'No', Stop he!<L 

PAQE 

14 

conll'ttclo< or 11Ub<>0-lor) will set~* -urilll requirement!< fnr IM)me <ii the 

1 otlhil> SF. 

STANDARD FORM XXXX XXIXXXX 
4316 Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 


lotter on DSK11XQN23PROD with PROPOSALS4EP15JA25.047</GPH>

Mtadmient 1: 0rganiZational Defined ParanlllerS (ODP)fOr NlST SP 800-172 

The 00Pa prowled in lllelloldtl!xt llelllwllholll be ~ibrllf!Ysecumy,equin!ment,I idenlllied llyllle agency. 

Specifil: set!Jrily~tobedelinedllylllelnfbmullkln!IYSlem-(le~ COlllnicloror~)-

idenlilied ill bladieted l!Old le,d. 

800-Ul!ID 

3.f.3e 

3.21e 

32.l!e 

3.4.l!e 

3.5.te 

3.l!.1e 

3.6.2e 

3.!Ue 

:U1.1e 

3.11.21, 

3.11.Se 

3.11.7e 

3.U.1e 

3.t3.1e 

3.13.28 

PAGE 

15 

··-

Secunty Rilanlement with ODP Vlllue 

Employlle!:UR>lnl'ormiltion-~k>conlR:lllnflllmallonllowabel.wlee,\sectmlydomalftllon 

cmmeded~ 

Pro'litle-11-..g-inltilll bile, fOlfflwinll a"Signllicantcybef_l, _ atleastllllftWlllr 

llocuoed-n,<Ogllimg-~11>---engineering.-~---

bmachea,-llU9l)iciDlls~updalelllelr-..gatteast""'"'811yorwl!enlhelearelllgnffleani: 

changes 11>111e-. 

lnl:ludeJlladil:lllexen:ise8 in-lnmlngli>rall-tailoredby ltlles,tolru:lude a-m-. usen, wilh apeciall,J!ed roles, and pr areallgnedwilhwmmt---

pmvide feedback lo indMdllals ilMllYed • their~ 

~ 

Employaw:m.-1-lo ~~~ ... 

remove 1hecomponems orplilee 1he ~Ina qwmmtlne or remedilllioR -lo 

fadllla1el)llld,!ng.~oro!hel"~ 

ldentlly-adlenlii:ales~and~ ~ wmn pomllie beforeeol8blishing anetworil 

tooneCticn uaq bidirectional aulhetllicallon lhat is~ baaed and replay--

Establish 

~ 

and mainlain a security ('llJel'llllona cen1er capab!lilyl!la!opemlell 2411, with allowance tor 

lltB!f. 

Establilih and main!ain "eyber lncidenl lhati:an be<lef)loye<lbyllle ~wllhin 24 

-· .I'll 

Conduct[~ acreemngtobe -.i by infarmallon ~ 

owner(l.e_.,_or~for--and---~-••"'"""lo 

CUI {ofllanintioo-defined frequency to be definedf,y informatioR ayate,n-(i.e., - or 

IIUbc:ontr-!}. 

Ernploy-~at•~-ape,,or _ _.,., _ _,.F-.illy 

pro-.tsorm:esaspaitofal'i!!lt-loguld!,anllinfolmlhetlevelopntentor~ 

.-,aecun1y-,-ofaecunly-.monilorillg.-llunling.and--

ieco-v llclivilie$. 

Cooducleyber-lltmlingadivlliea~,m aperiodlcbasisorwhenindicatioRSwmutlo -fcrimlicalors olcompmmlsein syslema anlldetetl, lnlck,anddisruplll!reatalhat 

e,,ade el<ialing ,:onlrols. • 

"-

~ 

lllee~ ofsecumy llllltlllonll at leastanmmlly or upon receq,t of-qberthreat 

or in """'°"""to a mleYantcybwincidentlo-antidpaled lisk lo~ 

11,sterm,andllleOlgllllizalion llalled on-andacctllllUisledthreat~. 

Develop a planforffilllllllllng suppy chailt nsuasaoeialedwilh ~ systems and system 

-,ponenis; update Ille plan atfelllltannually,and upon receipt of relevant cyber tllreatinfofmalion, or 

ln-to•mleYanteyberincident 

Cooduclpenelnllioftlulil19at least mmua!IJ•~-~lle®rlly changes are-to1he 

!IYatem, levell1ging lllllomated scanning IDols. ad hoc iesls uaq s,lbjedmaltetexi,erlll. 

Cmate dlYenlily in~ aytlliem ----to be defined by Information aystem owner(i.e., contracmr w ~loreduee llleextentofmaliCIDus mde pmpagalion. 

lmplementlhefoUowVl!lfflllll!l"Sll>~sy9telfflland!IYSlem~loinlrodueea4eg,eeof 

~into Ql!8<llliOns: ~ changes and frequency of dlanlles by sys1em 

and 

~ 

sys1em CCIQIPllMRl to be defined by~ sysiem-(i.e.,.,....._ IN' 

STANDARD FORM XXXX XX/XXXX 
Federal Register / Vol. 90, No. 9 / Wednesday, January 15, 2025 / Proposed Rules 4317 

[FR Doc. 2024–30437 Filed 1–14–25; 8:45 am] 

BILLING CODE 6820–EP–C 


lotter on DSK11XQN23PROD with PROPOSALS4EP15JA25.048</GPH>

lll!0-112!0 Securi1y Requirement-om> Value{conlinued) 

Employ(~teclmical-procedund-lobe-by~-- 3.U3e -ti.e~-«~Jtoconftllleand __ _ 

3.13.4e 1111d EmpioypbysicaliBolali<m syste,n eomponerlls. ledmiques orlogical..-.intecllniquesorllolhin ~ ~ 

3.13.Se 

~-relocalett,e-...igsystem 

-i,y..--....-.-, 

system-or-lobe 

---»-

orresoma,s~frequencylo be 

or~J:~ 

• systemownerji.e.,cmmact«or 

Verify !he inlegmy of se,;urlly Clilical---aoftware using moloflmst R-lioms or 3.14.1e ~ sigml!ureS. 

3.14.Se 

Ensure - specialized--..-of Things (!OT), lnduslJial lntemetofTiiings {IIOT), 

Operalionlll Tedlllolo!D'{OT),-Fumislled Equiflmel,t{GffJ, ReslrictedlllfonMlioo -~ Systems, __ equipment areinc-.!inlllescopeoflhe ~ ~ sewrilyrequnmentsor 

.. _ _., __ 

Reli"8h lo"" - by mfonmllion -- tl.e.. ~ --l~freqUency 

lledefinedby---owner(i.e.,-or--i}. 

Conduct...,_ofl)!mlislem~ slooige-not-lltan-.ly and remove CUIill no longer...,.,__ 

Use---am!effective~--at•-,openorcommen:ial 3.14.6e soun:es,-anyl'edenlllypmvided-!Dquideand lnfOm>----~-

3.14.7e 

PAGE 

1& 

erifylhe corrednes1oof{Ofllllllffiloon-defiMdsecunty trilic:alOl'esaential_,., Jimt_,_ 

11ar-_.-tobe-byinformationsystem-owner{l.e~COllbaelol'or-U 

umg{~verificalion~ortedmlquestolle_by ___ 

-tl.e.,-..or-,J. ~-

STAffDARtlroRMXXXXXl!OOOCX