Proposed FAR CUI NPRM Withdrawn

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that a Federal Acquisition Regulation (FAR) notice of proposed rulemaking (NPRM) submitted by DOD, GSA and NASA on  “FAR Case 2017-016, Controlled Unclassified Information (CUI)” had been withdrawn. No reason was given. This NPRM had been submitted to OIRA on March 7^th, 2022.

According to the abstract in the Spring 2022 Unified Agenda for this rulemaking:

“DoD, GSA, and NASA are proposing to amend the Federal Acquisition Regulation (FAR) to implement the National Archives and Records Administration (NARA) Controlled Unclassified Information (CUI) program of Executive Order 13556 of November 4, 2010 as implemented in NARA’s implementing regulations at 32 CFR 2002 [link added], and implement the OMB Memorandum M-17-12, entitled Preparing for and Responding to a Breach of Personally Identifiable Information (PII). This rule will apply the CUI program requirements in Federal contracts in a uniform manner to protect CUI. This rule is one element of a larger strategy to improve the Government’s efforts to identify, deter, protect against, detect and respond to increasing sophisticated threat actions targeting Federal contractors.”

This rulemaking has been on the Unified Agenda since 2017. There is no record of OMB meetings with stakeholders on this rulemaking.