Getting it Right: Establishing Uniform Policies for Controlled Unclassified Information

Leading federal contractors are warning that without specific, uniform, and comprehensive implementation and cost recovery options, proposed acquisition rule changes to implement the federal Controlled Unclassified Information (CUI) program will result in increased costs and program failure. Federal Acquisition Regulation (FAR) clauses are in the process of being finalized over the coming 12-18 months. After that point, departments and agencies will be required to adopt new policies and procedures based on forthcoming implementation guidance. During this implementation period, the National Archives’ Information Security Oversight Office (ISOO), which administers the CUI program, must ensure the feasibility of provisions addressing nine different challenges: (1) agency priorities and resources to implement new CUI rules, (2) standards for access to CUI, (3) implementation costs, (4) consistency, (5) proprietary information, (6) supply chain, (7) legacy data, (8) compliance management, and (9) acceptance and adoption.