The FAR CUI Rule Could Put Contractors on Rev. 3 Before DoD Does

CMMC’s phased rollout doesn’t determine when your other federal contracts could require NIST SP 800-171 Revision 3. The FAR CUI proposed rule contains no express implementation grace period and that could leave contractors managing two baselines on the same system. This week we examine DoD’s implementation extensions, explain what CMMC’s phases actually do, and discuss why contractors shouldn’t build their readiness plans around another extension. 2013 Rule: https://www.federalregister.gov/documents/2013/11/18/2013-27313/defense-federal-acquisition-regulation-supplement-safeguarding-unclassified-controlled-technical 2015 Rule: https://www.regulations.gov/document/DARS-2015-0039-0026 2016 Rule: https://www.federalregister.gov/documents/2016/10/21/2016-25315/defense-federal-acquisition-regulation-supplement-network-penetration-reporting-and-contracting-for 2020 Rule (CMMC 1.0): https://www.federalregister.gov/documents/2020/09/29/2020-21123/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of 2024 Rule (CMMC 2.0): https://www.federalregister.gov/documents/2024/10/15/2024-22905/cybersecurity-maturity-model-certification-cmmc-program 2025 Rule: https://www.federalregister.gov/documents/2025/09/10/2025-17359/defense-federal-acquisition-regulation-supplement-assessing-contractor-implementation-of FAR CUI Proposed: https://www.federalregister.gov/documents/2026/06/23/2026-12559/federal-acquisition-regulation-revolutionary-federal-acquisition-regulation-overhaul-parts-1-2-4-33 DoD Rev 2 vs Rev 3: https://youtu.be/iOKvkxcIivA?si=TeZZKmDvW7lgpqBz