FAR Cyber Clauses: 52.204-21, the FAR CUI rule and contractor reporting

Contractors to US civilian agencies face cyber obligations through the Federal Acquisition Regulation, not DFARS, and those obligations are being rewritten in 2026. Today the baseline is FAR 52.204-21, fifteen basic safeguarding requirements for any contractor system that holds federal contract information, plus supply chain prohibitions in FAR Subparts 4.20 to 4.23. In June 2026 the FAR Council reissued its proposed CUI rule as part of the Revolutionary FAR Overhaul, moving information security into a new FAR Part 40 with a 72 hour incident reporting duty. This guide explains what applies now, what is proposed, and how to prepare. It is for security, compliance and contracts teams at companies selling to civilian agencies, and for defence contractors who also hold civilian work. Defence-specific rules are covered in the DFARS 252.204-7012 Guide and CUI basics in the CUI Guide.

Status checked 9 November 2026: Acquisition.gov shows the FAR at FAC 2026-01, effective 13 March 2026, with 52.204-21 dated November 2021. The revised FAR CUI proposal is a proposed rule in FAR Case 2026-001 (Federal Register document 2026-12559), published on 23 June 2026 with comments due 30 days later, on 23 July 2026 according to Hunton and Covington. We found no final rule as of 9 November 2026. The proposal's details below rely on the Federal Register public inspection copy and on law firm summaries by Hunton, Cozen O'Connor, Covington and Mayer Brown, each attributed where used. It is a proposal, not a binding clause. Confirm against the official text before relying on it.

Key takeaways

• 52.204-21 is the floor: any contract where federal contract information (FCI) sits on or passes through your systems carries fifteen basic safeguarding requirements, flowed down to subcontractors except for COTS items.
• Supply chain bans are already live: FAR Subparts 4.20 to 4.23 restrict Kaspersky products, certain telecommunications and video surveillance equipment, the ByteDance covered application and items subject to Federal Acquisition Security Council orders.
• The FAR CUI rule is still proposed: the June 2026 version uses FAR 52.240-6, 52.240-7 and a Standard Form that tells contractors which CUI they hold and which safeguards apply.
• Reporting would move to 72 hours: the revised proposal replaced the eight hour window of January 2025 with 72 hours from discovery, with civilian reports to a CISA portal and 90 days of image preservation.
• Identity controls carry most of the weight: six of the fifteen basic requirements are about who and what can access the system, and that includes service accounts and API keys.

What applies now and what is proposed

FAR 52.204-21 in practice

The clause defines a covered contractor information system as one owned or operated by a contractor that processes, stores or transmits FCI. FCI is information not intended for public release that is provided by or generated for the government under a contract, excluding information the government has made public and simple transactional information such as that needed to process payments. Almost every federal contractor holds some FCI: statements of work, pricing discussions and deliverables in draft all count.

Paragraph (b)(2) says the clause does not relieve contractors of other agency safeguarding requirements or CUI requirements under Executive Order 13556. Paragraph (c) requires flowdown to subcontracts, including commercial products and services, where the subcontractor may have FCI on its systems; only COTS items are excepted. The fifteen requirements are also the CMMC Level 1 requirements under 32 CFR 170.14(c)(2), used by DoD; see the NIST SP 800-171 and CMMC 2.0 Guide.

The supply chain prohibitions

FAR Subparts 4.20 to 4.23 are the parts most often missed by security teams, because they read as procurement rules. They require representations at offer and, in several cases, reporting if a prohibited item is found during performance. The practical work is inventory: you cannot represent that you do not use covered equipment or applications unless asset and software inventories can show it. The June 2026 proposal would merge these restrictions into one clause, 52.240-3, apply a uniform "reasonable inquiry" standard and a 72 hour reporting window to all of them, and narrow some Section 889 "use" situations, according to Covington's analysis. See the NIST SP 800-161 Cyber Supply Chain Risk Management Guide for the wider discipline.

The proposed FAR CUI rule

The FAR Council first proposed a government-wide CUI rule in January 2025 (FAR Case 2017-016). On 23 June 2026 it reissued the rule within the Revolutionary FAR Overhaul, which, according to Hunton, supersedes the January 2025 text. Law firm summaries agree on the main features:

• New home: information security moves into an expanded FAR Part 40, Subpart 40.3, with solicitation provision 52.240-6 and contract clause 52.240-7.
• Standard Form: the agency completes a Standard Form (SF XXX in the proposal) identifying the CUI, where it resides and the safeguards that apply.
• Security standard: NIST SP 800-171 Revision 3 for contractor systems, replacing the Revision 2 basis of the January 2025 text; NIST SP 800-172 only where an agency identifies a critical programme or high value asset. See the NIST SP 800-171 Rev 3 Transition.
• Cloud: providers storing, processing or transmitting CUI must meet requirements equivalent to FedRAMP Moderate.
• Incident reporting: 72 hours from discovery (eight hours in January 2025), to a CISA portal for civilian contracts or DIBnet for defence, with the contracting officer notified, and images preserved for at least 90 days.
• Other 72 hour notices: unmarked or mismarked CUI, and conflicts with other law, including foreign law.
• Gaps at proposal: offerors that cannot meet every requirement disclose gaps and provide a plan of action and milestones, according to Mayer Brown.
• Narrower definitions: CUI excludes contractor-owned information not received from the government, and a CUI incident excludes "suspected" incidents and improper handling that causes no disclosure, modification or destruction, according to Covington.

Hunton reports the FAR Council expected to finalise the overhaul rules quickly, though we found no final rule by 9 November 2026, and that obligations would apply once the new text is placed in contracts, without a phase-in. Plan for that, but check the Federal Register for the final text, because details may change after comments.

Where identity fits

The basic safeguarding requirements speak of "processes acting on behalf of authorized users" and "devices", which is the clause's way of saying non-human identities. NHI Mgmt Group recommends:

• Register every process identity: service accounts, CI/CD tokens, API keys and AI agents that touch FCI or CUI systems need an owner, a purpose and a review date to satisfy (b)(1)(i) and (ii).
• Authenticate workloads properly: (b)(1)(vi) applies to processes and devices too; prefer short-lived federated credentials over static keys. See the Non-Human Identity (NHI) Guide.
• Control external connections: OAuth grants and SaaS integrations are external system connections under (b)(1)(iii); review and approve them.
• Plan for credential incidents: under the proposed 72 hour rule, a leaked key with access to CUI may be a reportable incident; make sure detection can tell you what the key could reach.

Implementation roadmap

1. Find your contracts and clauses: list civilian and defence contracts, the FAR and DFARS clauses in each, and whether they involve FCI or CUI.
2. Scope FCI systems: identify the systems and SaaS services where FCI lives or transits, including email and file sharing.
3. Close the fifteen basics: evidence each requirement with a named control and owner.
4. Prove the prohibitions: run hardware and software inventory checks for the Subpart 4.20 to 4.22 items and record the reasonable inquiry behind each representation.
5. Flow down: update subcontract templates with 52.204-21 and the prohibition clauses, and track supplier acknowledgements.
6. Prepare for Part 40: start an SP 800-171 Rev 3 gap assessment for any environment likely to hold civilian CUI, set up a CISA reporting route and a 90 day image preservation procedure, and draft a plan of action template.
7. Rehearse reporting: run a tabletop for a CUI incident and for discovery of a prohibited item, testing the 72 hour clocks.

Roll out new controls in a pilot enclave first; for regulated data, a separate CUI enclave can limit scope. See the CMMC Scoping Guide.

Decision guidance

• Enclave or whole estate: small contractors with little CUI usually benefit from an enclave; large firms with CUI spread across business systems may find estate-wide controls cheaper to run.
• Wait or prepare: because the proposal requires compliance once the clause is in a contract, waiting for the final rule leaves no time for an SP 800-171 Rev 3 programme. Start with the requirements least likely to change: access control, MFA, logging and incident reporting.
• Civilian and defence work: firms with both should run one control set mapped to both DFARS 252.204-7012 and the proposed FAR clause, noting that DFARS currently references SP 800-171 Rev 2 while the FAR proposal uses Rev 3.

Framework mapping

Detection and measurement

• Clause coverage: share of contracts with clauses recorded and systems mapped.
• Basic safeguarding evidence: requirements with current evidence, out of fifteen.
• Identity hygiene: service accounts and API keys on FCI systems with an owner and rotation date.
• Prohibited item checks: days since the last inventory sweep for covered equipment and applications.
• Reporting readiness: time to produce a report draft in tabletop tests, against 72 hours.

Common failure patterns

• Assuming FAR does not apply: civilian contractors treat cyber clauses as a defence issue and miss 52.204-21 entirely.
• Forgetting flowdown: subcontract templates omit 52.204-21, so suppliers holding FCI are unaware of the clause.
• Human-only access control: MFA is rolled out for staff while shared service accounts and long-lived keys keep standing access to FCI systems.
• Representations without inventory: prohibition representations are signed without evidence of a reasonable inquiry.
• Planning to the January 2025 text: teams built eight hour reporting and Rev 2 plans that the June 2026 proposal has superseded.

Practitioner checklist

• List every contract with FAR and DFARS cyber clauses and its data type (FCI, CUI).
• Map systems that hold or transmit FCI.
• Evidence all fifteen 52.204-21 requirements, including for service accounts and devices.
• Run and record inventory checks for Subparts 4.20 to 4.23.
• Flow 52.204-21 and the prohibition clauses down to subcontractors.
• Start an SP 800-171 Rev 3 gap assessment for likely CUI environments.
• Set up a CISA reporting route, 72 hour playbooks and 90 day image preservation.
• Watch the Federal Register for the final FAR Part 40 text.

Standards and references

• Acquisition.gov: FAR 52.204-21 Basic Safeguarding of Covered Contractor Information Systems
• Acquisition.gov: FAR Part 4 Administrative and Information Matters
• Hunton: FAR Council releases updated CUI proposed rule
• Covington Inside Government Contracts: Proposed FAR Part 40 rule
• Cozen O'Connor: The FAR Council is moving to a revised FAR CUI framework
• Mayer Brown: FAR Council proposes revised CUI safeguarding and incident reporting framework
• Federal Register (public inspection): Revolutionary FAR Overhaul Parts 1, 2, 4, 33, 39, 40 and 53, proposed rule
• eCFR: 32 CFR Part 170, CMMC Program

Related NHI Mgmt Group resources: DFARS 252.204-7012 Guide · CUI Guide · NIST SP 800-171 and CMMC 2.0 Guide · Non-Human Identity (NHI) Guide. This guide summarises FAR cyber clauses and the proposed FAR CUI rule as they stood on 9 November 2026 and is not legal advice.