DHS Updates CUI Safeguarding And Incident Reporting Requirements For Contractors

The U.S. Department of Homeland Security (DHS) issued a final rule¹ that revises the Homeland Security Acquisition Regulation (HSAR) to implement security and privacy measures for contractors to safeguard controlled unclassified information (CUI) and to revise contractor incident reporting requirements. The final rule follows a proposed rule DHS issued in 2017. The final rule is intended to ensure that federal CUI is adequately protected in situations when: CUI is accessed by contractor or subcontractor employees; CUI is collected or maintained on behalf of the agency; or federal information systems, including contractor information systems operated on behalf of the agency, are used to collect, process, store, or transmit CUI. To achieve this protection, the rule describes three HSAR clauses that contracting officers will immediately begin incorporating into new DHS solicitations and contracts.