OMB Approves DHS Contractor CUI Final Rule

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a final rule for DHS on “Homeland Security Acquisition Regulation: Safeguarding of Controlled Unclassified Information (HSAR Case 2015-001)”. This rule was submitted to OIRA on August 15^th, 2022.

According to the Fall 2022 Unified Agenda listing for this rulemaking:

“This Homeland Security Acquisition Regulation (HSAR) rule would implement security and privacy measures to ensure Controlled Unclassified Information (CUI), such as Personally Identifiable Information (PII), is adequately safeguarded by DHS contractors. Specifically, the rule would define key terms, outline security requirements and inspection provisions for contractor information technology (IT) systems that store, process or transmit CUI, institute incident notification and response procedures, and identify post-incident credit monitoring requirements.”

We may see this rule published later this week in the Federal Register.