Briefing · 23 Jun 2026
CUI is moving into FAR Part 40. CMMC Phase 2 is paused. Do not mix those two facts up.
On 23 June 2026 the FAR Council published an updated proposed rule on Controlled Unclassified Information as part of the Revolutionary FAR Overhaul (91 FR 37550). The CUI machinery is being relocated into an expanded FAR Part 40 (information security and supply chain security), superseding the January 2025 standalone proposal. Comments closed 23 July 2026. A 30-day comment window means they intend to move.
Separately, DoW paused CMMC Phase 2 implementation in a July 2026 class deviation. That pause is not a holiday from safeguarding CUI. It is a pause of one certification regime. The civilian CUI clause, when it lands, will still flow. So will DFARS 252.204-7012 on the defense side until it is rewritten.
Construction firms treat this as "IT work." It is not. Drawings, geotech, as-builts, and PII on a VA clinic job are CUI more often than a small GC wants to admit. If the new Part 40 clause hits a set-aside you are chasing, the evaluation can include a safeguarding plan you do not have.
What to do on the next bid
On every solicitation, search for CUI, NIST 800-171, CMMC, and Part 40. If any of them appear, do not bid as if they are boilerplate. Either you can meet the safeguarding requirement with the people and systems you actually have, or you team with someone who can. A bid/no-bid that ignores this is how you win a job you cannot perform.
Federal Register 23 Jun 2026 · FAR Council CUI proposed rule coverage, Hunton / Wiley, June 2026.