Federal Contractors Face Major Cybersecurity Rule Changes for Handling Sensitive Data
Federal government contractors that handle sensitive information are poised to undergo a significant shift in how they protect and report breaches involving controlled unclassified information, or CUI. This category of data includes personally identifiable information like Social Security numbers, details that could reveal vulnerabilities in critical infrastructure, and other sensitive but unclassified material. The proposed regulations, which have been under development for years, are nearing completion and could be finalized by the end of 2025 or shortly thereafter, according to attorneys specializing in federal procurement.
The rules are part of a broader effort to standardize cybersecurity requirements across federal agencies. Currently, contractors face a patchwork of varying standards due to inconsistent terminology used by different agencies — such as "sensitive but unclassified" or "for official use only." The new CUI framework aims to replace this fragmentation with a single, unified set of expectations for data protection and incident reporting.
72-Hour Breach Reporting Requirement Aligns with National Cybersecurity Goals
One of the most consequential elements of the proposed rule is the mandate that contractors report any unauthorized access to CUI — including incidents resulting from cyberattacks — within 72 hours of discovery. This timeline represents a compromise from an earlier draft that had proposed an 8-hour reporting window, which drew strong criticism from industry groups concerned about operational feasibility.
The 72-hour standard is intentionally aligned with upcoming reporting requirements under the Cybersecurity Incident Reporting for Critical Infrastructure Act (CIRCIA), which will require critical infrastructure owners and operators to report major cyber incidents to the Cybersecurity and Infrastructure Security Agency (CISA) within the same timeframe. This coordination aims to create a more cohesive national approach to cyber incident reporting.
Despite this alignment, some industry stakeholders continue to express concern. The Aerospace Industries Association, for example, has formally recommended extending the reporting window to 30 calendar days, arguing that the current timeline would be difficult and costly to meet without improving outcomes.
Contractors Must Adopt NIST SP 800-171 Standards and Flow Requirements to Subcontractors
Beyond reporting, the rule requires contractors handling CUI to implement baseline cybersecurity controls as defined in National Institute of Standards and Technology Special Publication 800-171 (NIST SP 800-171). These standards cover areas such as access control, system and communications protection, and incident response.
Experts note that the application of NIST SP 800-171 will extend to a broader range of contractors than ever before, including those working exclusively with civilian agencies who may not have previously been subject to such rigorous cybersecurity obligations.
A key component of compliance involves flowing these requirements down to subcontractors. Prime contractors will need to identify which portions of CUI they share with downstream partners and establish oversight mechanisms to ensure those subcontractors also adhere to the required safeguards.
Non-Compliance Could Trigger False Claims Act Liability
Legal experts warn that failure to comply with the new CUI rules could expose contractors to significant liability under the False Claims Act. Since 2022, the federal government has increasingly used this statute to penalize contractors for inadequate cybersecurity practices, treating misrepresentations about compliance as false claims for payment.
As one government contracts partner noted, the rule could bring "a whole new universe of contractors" under False Claims Act risk — particularly those who have not historically dealt with defense-related contracts but now handle CUI for civilian agencies.
Implementation Timeline and Next Steps Remain Under Review
While the exact timing of the final rule remains uncertain, sources indicate that the Trump administration has prioritized completing the regulation before the end of its term. Attorneys suggest that either an interim rule or a final version could be issued in the coming months.
Some aspects of the rule are still being refined, including the mechanism for incident reporting. Current drafts require contractors to report to agency-specific points of contact rather than a centralized federal hub, a structure that has drawn criticism for potentially creating duplicative reporting burdens. Observers note that coordination between CISA and the Department of Defense will be critical to determining whether a unified reporting system emerges.
Despite ongoing discussions, legal observers agree that the core requirements have stabilized. Compared to earlier versions of the proposal, the current draft reflects greater consistency, indicating that key elements — such as the 72-hour reporting window and NIST SP 800-171 compliance — are likely to remain intact in the final rule.
Source: CyberScoop