Client Alert: FAR Council Issues Long-Awaited Proposed Rule To Implement Controlled Unclassified Information Program

On January 15, 2025, the Department of Defense (DOD), General Services Administration (GSA), and the National Aeronautics and Space Administration (NASA) (collectively, "the FAR Council") issued a long-anticipatedproposed rule to amend the Federal Acquisition Regulation (FAR) to implement the National Archives and Records Administration's (NARA) Controlled Unclassified Information (CUI) Program. The CUI program establishes a unified approach to manage information that requires safeguarding or dissemination control by virtue of some law, regulation, or governmentwide policy. For government contractors tasked with protecting such unclassified information on federal or non-federal information systems, the proposed rule creates new compliance obligations and expectations. And given that recent enforcement actions have increasingly prioritized information protection and cybersecurity (as we covered here and here), contractors should pay close attention to these evolving