Review - GSA Publishes FAR NPRM on Controlled Unclassified Information

Today the GSA (and DOD and NASA) published a notice of proposed rulemaking in the Federal Register (90 FR 4278-4317) on “Federal Acquisition Regulation (FAR): Controlled Unclassified Information (CUI)”. This rulemaking would modify and extend provisions in existing FAR, providing information on how contractors would be expected to handle CUI obtained, used, or created in the course of federal contract work. These rules would implement the requirements of regulations created by the National Archives and Records Administration (NARA) pursuant to the requirements of EO 13556, “Controlled Unclassified Information”.

Background 

The government has long tried to restrict access to sensitive information. National security information is protected by rules related classified information, but those rules do not apply to less sensitive information. Over the years agencies have come up with a number of different information control schemes for various types of information with varying levels of formal and informal rules about how that information should be protected. Needless to say, that odd mix of systems was confusing, unworkable, and, practically speaking, unenforceable.

In 2010 President Obama attempted to address this issue by releasing EO 13556. He designated NARA as the agency responsible for formulating the regulations necessary to implement the requirements outlined in the Executive Order. In 2015 NARA published their regulations at 32 CFR 2002. In general, the NARA CUI rules applied to government organizations, not people outside of the government. The one exception was government contractors that handled CUI as part of their contractual duties to the federal government.

I did a blog post when NARA published their rule. Between it and the notice of proposed rulemaking posts mentioned in that blog post, this provides a good deal of background on the regulation that this rulemaking is trying to adopt into the FAR.

Public Comments

GSA is soliciting public comments on this proposed rule. Comments may be submitted via the Federal eRulemaking Portal (www.Regulation.gov; Docket # 2017-0016, Sequence No. 1). Comments should be submitted by March 17^th, 2025.

 

For more information about this rulemaking, including a discussion of the NIST SP 800-171 cybersecurity requirements, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/gsa-publishes-far-nprm-on-controlled - subscription required.

Review - S 5028 Introduced – Contractor VDP

Last month Sen Warner (D,VA) introduced S 5028, the Federal Contractor Cybersecurity Vulnerability Reduction Act of 2024. The bill would require changes to the Federal Acquisition Regulations to require federal contractors to have a vulnerability disclosure program. No new funding is authorized by this legislation.

This bill is very similar in intent to HR 5310 and HR 5255. The major difference between this bill and the other two is that the Senate bill is focused on the FAR as the mechanism for requiring contractors to have a vulnerable disclosure program. There has been no action taken on HR 5310, but HR 5255 was amended and ordered favorably reported back in May. That report has not yet been published.

Moving Forward

While Warner is not a member of the Senate Homeland Security and Governmental Affairs Committee to which this bill was assigned, his sole cosponsor {Lankford (R,OK)} is a member. This means that there may be sufficient influence to see the bill considered in Committee. Beyond the increased regulation of contractors which some elements of the Republican fringe have a knee-jerk opposition to, I see nothing that would cause any organized opposition to this bill. I suspect that this bill would receive some level of bipartisan support in Committee.

 

For more information about the provisions of the bill, as well as more discussion about it’s prospects, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/s-5028-introduced - subscription required.

OMB Approves FAR CUI NPRM

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a notice of proposed rulemaking (NPRM) for the Federal Acquisition Regulations (FAR) on “FAR Case 2017-016, Controlled Unclassified Information (CUI)”. This NPRM was sent to OMB on May 21^st, 2024. This rulemaking has been under consideration since 2017

According to the Spring 2024 Unified Agenda entry for this rulemaking:

“This rule will apply the controlled unclassified information (CUI) program requirements in Federal contracts in a uniform manner to protect CUI. This rule is one element of a larger strategy to improve the Government’s efforts to identify, deter, protect against, detect, and respond to increasing sophisticated threat actions targeting Federal contractors. This rule is being issued in accordance with the National Archives and Records Administration (NARA) regulations implementing the CUI program per Executive Order 13556 [link added] issued November 4, 2010, as implemented in NARA’s implementing regulations [link added].”

I will probably not be covering this regulation in any depth, but I will at least mention the publication of the NPRM in the appropriate ‘Short Takes’ post.

OMB Approves FAR Software Supply Chain Security NPRM

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a notice of proposed rulemaking for the Federal Acquisition Regulation on “Federal Acquisition Regulation (FAR); FAR Case 2023-002, Supply Chain Software Security”. This NPRM was sent to OIRA on March 9^th, 2024.

According to the Fall 2023 Unified Agenda entry for this rulemaking:

“This rule will require suppliers of software available for purchase by Federal agencies to comply with, and attest to complying with, applicable secure software development practices.  This rule is being issued in accordance with section 4(n) and 4(k) of the Executive Order 14028 [link added] titled "Improving the Nation's Cybersecurity” and Office of Management and Budget Memorandum 22-18 and 23-16 [links added].”

Sounds like another use for CISA’s Software Attestation form….

FAR Sends CUI NPRM to OMB

Yesterday, the OMB’s Office of Information and Regulatory Affairs announced that it had received a notice of proposed rulemaking from FAR on “Federal Acquisition Regulation (FAR); FAR Case 2017-016, Controlled Unclassified Information (CUI)”. This rulemaking has been under consideration since 2017.

According to the Fall 2023 Unified Agenda entry for this rulemaking:

“This rule will apply the controlled unclassified information (CUI) program requirements in Federal contracts in a uniform manner to protect CUI. This rule is one element of a larger strategy to improve the Government’s efforts to identify, deter, protect against, detect, and respond to increasing sophisticated threat actions targeting Federal contractors. This rule is being issued in accordance with the National Archives and Records Administration (NARA) regulations implementing the CUI program per Executive Order 13556 issued November 4, 2010, as implemented in NARA’s implementing regulations.”

FAR sends Supply Chain Software Security NPRM to OMB

On Thursday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a notice of proposed rulemaking (NPRM) from FAR on “Federal Acquisition Regulation (FAR); FAR Case 2023-002, Supply Chain Software Security”. 

According to the Fall 2023 Unified Agenda entry for this rulemaking:

“This rule will require suppliers of software available for purchase by Federal agencies to comply with, and attest to complying with, applicable secure software development practices.  This rule is being issued in accordance with section 4(n) and 4(k) of the Executive Order 14028 titled "Improving the Nation's Cybersecurity” and Office of Management and Budget Memorandum 22-18 and 23-16.”

Interesting to note that the UA entry ‘expected’ the NPRM to be published in December of 2023. It will almost certainly be another month or three before this rulemaking makes its way into the Federal Register.

FAR Semiconductor ANPRM Sent to OMB

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received an advanced notice of proposed regulation (ANPRM) for “Federal Acquisition Regulation (FAR); FAR Case 2023-008, Prohibition on Certain Semiconductor Products and Services”.

According to the Fall 2023 Unified Agenda entry for this rulemaking:

“This rule will prohibit agencies from: (1) procuring or obtaining, or extending or renewing a contract to procure or obtain, any electronic parts, products, or services that include covered semiconductor products or services; or (2) entering into a contract, or extending or renewing a contract, with an entity to procure or obtain electronic parts or products that include covered semiconductor products or services.  This rule is issued pursuant to section 5949(a) of the National Defense Authorization Act for Fiscal Year 2023 [PL 117-263].”

Review - HR 5255 Introduced – Contractor VDP

Last month, Rep Mace (R,SC) introduced HR 5255, the Federal Cybersecurity Vulnerability Reduction Act of 2023. The bill would require the OMB and DOD to review Federal Acquisition Regulations (FAR) to ensure that covered contractors implement a vulnerability disclosure policy consistent with NIST guidelines for contractors as required by 15 USC 278g–3c. No funding is authorized by this legislation.

Moving Forward

Mace is a member of the House Oversight and Accountability Committee to which this bill was assigned for consideration. This means that there may be sufficient influence to see the bill considered in Committee. I see nothing in this legislation that should engender any organized opposition. The bill should receive some level of bipartisan support if considered. I suspect that this bill would receive sufficient bipartisan support to allow it to be considered under the House suspension of the rules process when taken up by the full House.

Commentary

Interestingly, most of the requirements set forth in this bill are already incorporated in §278g–3c and §278g–3d in 15 USC. Specifically, the requirement to set appropriate FAR guidelines, is included in §278g-3d(d). Unfortunately, the timelines set forth in the two existing sections of 15 USC have passed without the required action taking place. I do not think that the setting of new timelines like we see in this bill will have any material impact on the acquisition regulations absent some specific new requirements. I would suggest that a §3 be added to the bill:

“SEC. 3. REPORT TO CONGRESS­—The Director of the Office of Management and Budget will within 30 days of the enactment of this bill will provide a report to Congress on the reasons why the regulatory time limits in §278g–3c(a) and §278g–3d(a) have not been met. The report will include a timeline for the agency’s completing the requirements of the two subsections.”

For more details about the provisions of the bill, see my article at CFSN Detailed Analysis - https://patrickcoyle.substack.com/p/hr-5255-introduced - subscription required.

OMB Approves FAR NPRM on Cyber Incident Reporting

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a Federal Acquisition Regulation (FAR) notice of proposed rulemaking (NPRM) for “FAR Case 2021-017, Cyber Threat and Incident Reporting and Information Sharing”. The NPRM was sent to OIRA for review on May 11^th, 2023.

According to the Spring Unified Agenda entry for this rulemaking:

“DoD, GSA, and NASA are proposing to amend the Federal Acquisition Regulation (FAR) to increase the sharing of information about cyber threats and incident information between the Government and certain providers, pursuant to Office of Management and Budget recommendations, in accordance with section 2 (b)-(c), and Department of Homeland Security (DHS) recommendations, in accordance with section 8(b), of Executive Order (E.O.) 14028, Improving the Nation’s Cybersecurity. In addition, the rule will propose requiring certain contractors to report cyber incidents to the Federal Government to facilitate effective cyber incident response and remediation, pursuant to DHS recommendations in accordance with sections 2(g)(i) of E.O. 14028.”

This NPRM will likely be published in the Federal Register sometime next week.

FAR Interim Final Rule for FASC Exclusion Orders to OMB -

On Friday, the OMB’s Office of Information and Regulatory Affairs announced that it had received a Federal Acquisition Regulation (FAR) interim final rule “FAR Case 2020-011, Implementation of FASC Exclusion Orders”. The rule would implement requirements of §202 of the SECURE Technology Act (PL 115-390).

According to the Fall 2022 Unified Agenda entry for this rulemaking:

This rule will amend the Federal Acquisition Regulation (FAR) to address implementation of issued exclusion orders authorized by section 202 of the SECURE Technology Act (115 Pub. L. 390), which amends 41 U.S.C. 1323 by creating the Federal Acquisition Security Council (FASC) and authorizing the Secretary of Homeland Security, the Secretary of Defense, and the Director of National Intelligence to issue exclusion orders, upon the recommendation of the FASC. These orders are issued to protect national security by excluding certain covered products, services, or sources from the Federal supply chain.

FAR Application Use IFR Approved by OMB

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved an interim final rule (IFR) under the Federal Acquisition Regulation (FAR) for “FAR Case 2023-010, Prohibition on Using a Covered Application”. The IFR was submitted to OIRA on March 20, 2023. This rulemaking was not listed in the Fall 2020 Unified Agenda, so there is no official listing of its purpose, but I suspect that this may just have something to do with the Tik Tok application. We may see this rule published later this week.

FAR Unclassified System Cybersecurity NPRM Sent to OMB – 5-11-23

Earlier this week, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a Federal Acquisition Regulation (FAR) notice of proposed rulemaking (NPRM) for “FAR Case 2021-019, Standardizing Cybersecurity Requirements for Unclassified Information Systems”. An earlier version of this NPRM was recently withdrawn from review at OMB.

According to the Fall 2022 Unified Agenda listing for the rulemaking:

“DoD, GSA, and NASA are proposing to amend the Federal Acquisition Regulation to standardize common cybersecurity contractual requirements across Federal agencies for unclassified Federal information systems, pursuant to Department of Homeland Security recommendations in accordance with sections 2(i) and 8(b) of Executive Order 14028, Improving the Nation’s Cybersecurity.  As a result, this rule will ensure Federal information systems are better positioned to protect from cybersecurity threats.”

There is no public record of what may have changed between the earlier version of this NPRM and the one currently being reviewed by OIRA.

FAR Cyber Incident Reporting NPRM Sent to OMB – 5-11-23

Earlier this week, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a Federal Acquisition Regulation (FAR) notice of proposed regulations (NPRM) for “FAR Case 2021-017, Cyber Threat and Incident Reporting and Information Sharing”. An earlier version of this NPRM was recently withdrawn from review at OMB.

According to the Fall 2022 Unified Agenda entry for this rulemaking:

“DoD, GSA, and NASA are proposing to amend the Federal Acquisition Regulation (FAR) to increase the sharing of information about cyber threats and incident information between the Government and certain providers, pursuant to OMB recommendations, in accordance with section 2 (b)-(c), and Department of Homeland Security recommendations, in accordance with section 8(b), of Executive Order 14028, Improving the Nation’s Cybersecurity. In addition, requires certain contractors to report cyber incidents to the Federal Government to facilitate effective cyber incident response and remediation, pursuant to Department of Homeland Security recommendations in accordance with sections 2(g)(i) of Executive Order 14028.”

There is no public record of what may have changed between the earlier version of this NPRM and the one currently being reviews by OIRA.

FAR App Prohibition Interim Final Rule Sent to OMB

OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a FAR regulation on “FAR Case 2023-010, Prohibition on Using a Covered Application”. This rulemaking was not listed in the Fall 2020 Unified Agenda, so there is no official listing of its purpose, but I suspect that this may just have something to do with the Tik Tok application.

FAR Cyber Incident Reporting NPMR to OMB

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a Federal Acquisition Regulation notice of proposed rule making for “FAR Case 2021-017, Cyber Threat and Incident Reporting and Information Sharing”. According to the listing in the 2022 Spring Unified Agenda:

“DoD, GSA, and NASA are proposing to amend the Federal Acquisition Regulation (FAR) to increase the sharing of information about cyber threats and incident information between the Government and certain providers, pursuant to OMB recommendations, in accordance with section 2 (b)-(c), and Department of Homeland Security recommendations, in accordance with section 8(b), of Executive Order 14028, Improving the Nation’s Cybersecurity. In addition, requires certain contractors to report cyber incidents to the Federal Government to facilitate effective cyber incident response and remediation, pursuant to Department of Homeland Security recommendations in accordance with sections 2(g)(i) of Executive Order 14028 [link added].”

FAR Cybersecurity for Unclassified Information NPRM to OMB

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a Federal Acquisition Regulation (FAR) notice of proposed regulation for “FAR Case 2021-019, Standardizing Cybersecurity Requirements for Unclassified Information Systems”. According to the entry in the 2022 Spring Unified Agenda listing for this rulemaking:

“DoD, GSA, and NASA are proposing to amend the Federal Acquisition Regulation (FAR) to standardize common cybersecurity contractual requirements across Federal agencies for unclassified information systems, pursuant to Department of Homeland Security recommendations in accordance with sections 2(i) and 8(b) of Executive Order 14028 [link added], Improving the Nation’s Cybersecurity.”

Proposed FAR CUI NPRM Withdrawn

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that a Federal Acquisition Regulation (FAR) notice of proposed rulemaking (NPRM) submitted by DOD, GSA and NASA on  “FAR Case 2017-016, Controlled Unclassified Information (CUI)” had been withdrawn. No reason was given. This NPRM had been submitted to OIRA on March 7^th, 2022.

According to the abstract in the Spring 2022 Unified Agenda for this rulemaking:

“DoD, GSA, and NASA are proposing to amend the Federal Acquisition Regulation (FAR) to implement the National Archives and Records Administration (NARA) Controlled Unclassified Information (CUI) program of Executive Order 13556 of November 4, 2010 as implemented in NARA’s implementing regulations at 32 CFR 2002 [link added], and implement the OMB Memorandum M-17-12, entitled Preparing for and Responding to a Breach of Personally Identifiable Information (PII). This rule will apply the CUI program requirements in Federal contracts in a uniform manner to protect CUI. This rule is one element of a larger strategy to improve the Government’s efforts to identify, deter, protect against, detect and respond to increasing sophisticated threat actions targeting Federal contractors.”

This rulemaking has been on the Unified Agenda since 2017. There is no record of OMB meetings with stakeholders on this rulemaking.

FAR NPRM Covering CUI Sent to OMB

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a new Federal Acquisition Regulation (FAR) notice of proposed rulemaking (NPRM) for “FAR Case 2017-016, Controlled Unclassified Information (CUI)”.

According to the Fall 2021 Unified Agenda listing for this rulemaking:

“DoD, GSA, and NASA are proposing to amend the Federal Acquisition Regulation (FAR) to implement the National Archives and Records Administration (NARA) Controlled Unclassified Information (CUI) program of Executive Order 13556 of November 4, 2010 as implemented in NARA’s implementing regulations at 32 CFR 2002, and implement the OMB Memorandum M-17-12, entitled Preparing for and Responding to a Breach of Personally Identifiable Information (PII). This rule will apply the CUI program requirements in Federal contracts in a uniform manner to protect CUI. This rule is one element of a larger strategy to improve the Government’s efforts to identify, deter, protect against, detect and respond to increasing sophisticated threat actions targeting Federal contractors.”

The NARA CUI rule was published in September 2016. Among other requirements, it requires {32 USC 2002.14(h)(2)} non-governmental entities handling CUI on computer systems to comply with NIST SP 800-171.

OMB Receives Anti-Kaspersky FAR Rule for Review

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received for review an interim final rule for a Federal Acquisition Regulation (FAR) for the use of products or services from the Kaspersky Labs. This rulemaking was not included in the Fall 2017 Unified Agenda.

This is probably a rule implementing the requirements of §1634 of HR 2810, the National Defense Authorization Act for Fiscal Year 2018. That bill was signed into law on December 12^th, 2017 (PL 115-91, not yet printed); which would explain why this rule did not make the last Unified Agenda.

That section would prohibit any “department, agency, organization, or other element of the Federal Government” from using “any hardware, software, or services developed or provided, in whole or in part, by” {§1634(a)} Kaspersky Labs. The effective date of that prohibition is October 1^st, 2018 which is undoubtedly the reason for going the ‘interim final rule’ route.

OMB Approves Contractor Data Security Rule

Yesterday the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved the new Federal Acquisition Regulation establishing Basic Safeguarding of Contractor Information Systems. As I noted in an earlier post, the rule would add a new subpart and contract clause for the basic safeguarding of contractor information systems that contain, transmit, or process Federal contract information.

This rule would only directly apply to federal contractors operating under FAR based contracts (DOD, NASA, and GSA for instance), but it does establish a precedence for federally established security rules that apply to unclassified IT systems.