CUI

A GSA Office of Inspector General audit found all 11 sampled Public Buildings Service contract files incomplete in EASi and identified inconsistent marking of controlled unclassified information. PBS agreed with four recommendations and is developing a corrective action plan, with implications for acquisition recordkeeping, CUI handling, and contractor documentation support.

The U.S. Air Force has issued a second request for information on the future Air Force Long-Range Weapon, seeking industry perspectives on its acquisition strategy and incremental weapon architecture. This is a market-research opportunity—not a contract award—and respondents should review the RFI’s access conditions and controlled unclassified information requirements.

NIST SP 800-171 Revision 3 modernizes CUI safeguards with 97 requirements across 17 families, but DoD Class Deviation 2024-O0013 retains Revision 2 for DFARS 252.204-7012 and CMMC Level 2 until acquisition regulations are updated. Contractors should follow the revision specified in each solicitation and contract rather than assume Revision 3 automatically applies.

A November 12 virtual webinar will compare NIST SP 800-171 Revision 3 with Revision 2 and discuss connections to GSA CUI guidance and the proposed FAR CUI Rule. Contractors, particularly defense firms still using Revision 2, can use the session to inform compliance planning while distinguishing current requirements from proposed changes.

USACE Mobile District has made materials available from its October 28, 2026, industry day for the Selma, Alabama, Flood Risk Management and Bank Stabilization Project. Contractors must contact the contracting office to verify DoD contractor eligibility and meet access requirements before obtaining the CUI briefing deck and attendance sheet; no solicitation, value, or award timeline is identified.

A GSA Office of Inspector General audit found 116 files containing controlled unclassified information were accessible to agency employees and contractors without a legitimate need to know. GSA agreed to seven recommendations and reported corrective steps, highlighting security-control priorities for contractors supporting cloud collaboration, CUI discovery, and data-loss prevention—but no new solicitation or contract has been announced.

eSoftware Associates advises defense contractors to review user permissions, sensitivity labels, encryption, and tenant settings before licensing Microsoft 365 Copilot in GCC High, because the cloud environment does not fix overbroad file access. A reported pause in CMMC Phase II requirements does not eliminate obligations already incorporated into active solicitations or contracts.

The FAR Council has proposed new rules aimed at modernizing federal procurement processes. These changes focus on reducing requirements and enhancing contractor flexibility, affecting key areas such as cybersecurity and CUI management. Contractors are urged to review these proposals before the comment period closes on July 23, 2026.