Federal contractors are facing two separate cybersecurity rule tracks, not one single “new rule.” A government-wide FAR proposal would standardize how agencies identify and communicate Controlled Unclassified Information (CUI) requirements, while DoD’s separate DFARS rule made Cybersecurity Maturity Model Certification (CMMC) requirements contractually effective on November 10, 2025. DoD then suspended CMMC Phase II immediately on July 13, 2026, for a program review. That pause does not remove the underlying duty to protect federal data.
Two rule tracks are moving on different legal timelines
The headline combines two related developments that have different coverage and legal effects. FAR Case 2017-016 is a proposed government-wide rule for handling CUI in federal contracting. DFARS Case 2019-D041 is a DoD-specific acquisition rule that makes CMMC status part of certain contract solicitations and awards.
As an Amazon Associate I earn from qualifying purchases.
| Issue | FAR Case 2017-016 | DFARS Case 2019-D041 |
|---|---|---|
| Coverage | Government-wide contracts involving CUI | DoD contracts requiring CMMC |
| Status | Proposed January 15, 2025; listed at final-rule stage in the Spring 2025 Unified Agenda, but not thereby final | Final action recorded September 10, 2025; effective November 10, 2025 |
| Main mechanism | Standardized CUI communication, a proposed Standard Form, FAR clauses and a solicitation provision | CMMC levels, assessments or status, affirmations and solicitation eligibility |
| 2026 development | No replacement schedule established in the materials reviewed | Phase II suspended July 13, 2026, while DoD reviews the program |
Keeping these tracks separate matters. A change to CMMC implementation does not automatically finalize, repeal or rewrite the government-wide FAR proposal.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →What the proposed FAR CUI rule would change
Its purpose is consistent contract communication
DoD, GSA and NASA proposed FAR changes to apply NARA’s Federal CUI Program to contract performance. The proposal addresses situations in which CUI is on federal systems or resides on, passes through, or is handled by contractor systems and facilities.
The proposal’s central problem is inconsistency. As the agencies wrote, “Currently laws, Federal regulations, and Government-wide policies already mandate these protections, but there is not a standard way these requirements are identified and shared with contractors.” The proposed framework is therefore primarily an acquisition and contract-administration mechanism for telling contractors which CUI requirements apply and how incidents must be reported.
Proposed forms, clauses and reporting details
The proposal would introduce a common form for communicating CUI requirements, identified in the proposal as Standard Form. It would also add FAR clauses and a solicitation provision. The agencies asked whether contractors need additional compliance guidance, whether multiple incident-reporting timelines could apply to the same organization, and how differing reporting requirements would affect operations.
Those questions are important because a contractor can work under several agencies or contracts with different reporting instructions. The proposed rule is intended to make those instructions more predictable; it is not a declaration that contractors previously had no CUI safeguards.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What the proposal does not do
The proposal states that FAR Part 24 Privacy Act requirements are unchanged. It also anticipated separate future rulemaking to update NIST SP 800-171 and SP 800-171A to then-current versions. The FAR CUI proposal itself should not be described as the rule that updated those NIST publications.
Where the FAR proposal stands
The proposal was published on January 15, 2025. The Spring 2025 Unified Agenda listed FAR Case 2017-016 at the final-rule stage and said comments were being considered. An agenda entry is not a published final rule, so contractors should not treat that listing as proof that final FAR text, effective dates or universal contract clauses already exist.
How the DoD CMMC acquisition rule works
The solicitation determines the required level
Current DFARS text directs contracting officers to include a required CMMC level in a solicitation when the DoD program office or requiring activity specifies one. A contractor’s award eligibility then depends on having the required status for the relevant systems used to process, store or transmit Federal Contract Information (FCI) or CUI.
Rank #3
Status and annual affirmations must be maintained when the contract requires them. The operative solicitation language and applicable DFARS clauses control an individual procurement; a general description cannot replace those documents.
Level-specific status rules
Current text describes conditional Level 2 and Level 3 statuses for a period of up to 180 days. Level 1 requires final status for award. These distinctions can affect whether a company may compete or receive an award, so a contractor should confirm the exact level, assessment condition and system boundary stated in its solicitation.
Clause timing
DFARS clause 252.204-7021 is used in solicitations through November 9, 2028 when a specific CMMC level is required, with a later applicability condition beginning November 10, 2028. Because clause applicability can depend on the procurement and the current DFARS text, contractors should check the solicitation rather than rely on a calendar date alone.
Estimated public cost
The 2025 Unified Agenda entry for DFARS Case 2019-D041 estimated $16 million in annualized public costs, using 2024 as the base year. That figure is an estimate for the CMMC acquisition rule; it is not an estimate for the separate FAR CUI proposal.
What the July 13, 2026 Phase II suspension means
The suspension is immediate and tied to a review
DoD announced an immediate suspension of CMMC Phase II requirements on July 13, 2026, ahead of the previously scheduled November 10, 2026 milestone. DoD’s CIO resource page and the official announcement describe a program review.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThe Department of War announcement expressly cautions: “It is critical to note that this action does not eliminate the requirement for companies to protect federal data.” In practical terms, suspending a program phase is not the same as repealing statutory, regulatory or contractual safeguarding duties.
What has not been decided
The July 13 materials do not establish a replacement milestone schedule. They also do not resolve every contract-modification question or state that every existing CMMC-related clause has been withdrawn. Contractors should avoid assuming a universal extension, cancellation or modification unless DoD issues written guidance or the contracting officer changes the contract.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What contractors should do now
- Read each solicitation and contract. Identify CUI and FCI definitions, system boundaries, required CMMC level, assessment or affirmation language, incident-reporting deadlines and incorporated DFARS clauses.
- Map the systems covered by the requirement. Confirm which environments process, store or transmit FCI or CUI. CMMC status applies to the relevant systems, not automatically to every asset a company owns.
- Verify status and affirmations where required. Check assessment status, any conditional Level 2 or Level 3 period, annual affirmations and required entries in the Supplier Performance Risk System (SPRS) when the contract calls for them.
- Maintain existing safeguards and reporting. Continue protecting federal information and follow the incident-reporting and security clauses already incorporated into the contract. The Phase II pause is not permission to stop controls.
- Track official DoD instructions and contracting-officer notices. Watch for updates from DoD’s CMMC program resources and review any bilateral modification or written direction before changing a contract compliance plan.
- Prepare for clearer CUI communication without assuming final FAR text. Keep an inventory of CUI categories, handling locations, subcontractor flows and reporting contacts so that a future standardized form or clause can be implemented quickly.
Timeline of the major actions
| Date | Event |
|---|---|
| October 15, 2024 | DoD’s CMMC Program final rule was published at 89 FR 83092, establishing the framework in 32 CFR Part 170. |
| January 15, 2025 | DoD, GSA and NASA published the proposed FAR CUI rule for FAR Case 2017-016. |
| Spring 2025 | The Unified Agenda listed FAR Case 2017-016 at the final-rule stage while comments were being considered; this did not itself publish a final rule. |
| September 10, 2025 | Final action on DFARS Case 2019-D041 was recorded. |
| November 10, 2025 | The DoD DFARS CMMC acquisition rule became effective. |
| July 13, 2026 | DoD suspended CMMC Phase II immediately and announced a program review. |
| November 10, 2026 | The previously scheduled Phase II milestone was overtaken by the July suspension; no replacement date was stated in the suspension materials. |
Answers to the questions contractors are asking
What do federal contractors have to do to protect CUI?
Follow the protections, system requirements and reporting instructions in the applicable laws, regulations, policies and contract clauses. The FAR proposal is designed to communicate those requirements more consistently; it does not create a period in which CUI can be left unprotected.
Does the proposed FAR rule apply to every contract?
It is government-wide in scope but remains a proposal in the latest status identified here. Whether a particular obligation applies depends on the final FAR text, the solicitation and the contract’s incorporated clauses.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Is CMMC Phase II still happening?
DoD suspended Phase II immediately on July 13, 2026 and began a review. The announcement does not provide a replacement schedule, so contractors should rely on current solicitation terms and subsequent official DoD instructions.
Did the pause eliminate cybersecurity requirements?
No. DoD’s announcement specifically says the requirement to protect federal data remains. Only the status and timing of the Phase II program are under review in the cited materials.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
