Explore the most important new and upcoming regulations you need to know about.
Upcoming cybersecurity regulations for 2026 include a proposed FAR rule for Controlled Unclassified Information (CUI) that would reach civilian agency contractors, a CMMC Phase 2 pause, and a federal incident reporting rule that has not been published yet. We update this page as rules and regulations change – so check back in the future for the latest updates.
Key Takeaways
- – The proposed FAR CUI rule would apply NIST SP 800-171 Revision 3 and a 72-hour incident reporting deadline to civilian agency contractors that handle CUI.
- – DFARS 252.204-7012 still points defense contractors to Revision 2, so a contractor with both defense and civilian customers may need to track two revisions for now.
- – The Department of War suspended CMMC Phase 2 on July 13, 2026, and a September 3 class deviation directs contracting officers to remove third-party assessment requirements, while the NIST SP 800-171 obligations in DFARS 252.204-7012 still apply.
Table of Contents
Upcoming Regulations for 2026
The CMMC Phase 2 Pause and the Task Force review.
The DoW suspended CMMC Phase 2 on July 13, 2026. A September 3 class deviation directs contracting officers to remove third-party assessment requirements from contracts. Self-assessments, SPRS scores, and DFARS 252.204-7012 obligations still apply. The Task Force report was unpublished as of October 19. Read our Phase 2 pause article for more details.
NIST SP 800-171 Revision 2 vs Revision 3: Which one applies?
Defense contractors with DFARS 252.204-7012 in their contracts are still held to NIST SP 800-171 Revision 2. Government-led assessments by the Defense’s own assessors use it too. A class deviation keeps Revision 2 in place until the DoW incorporates Revision 3 into 32 CFR part 170 through rulemaking. Revision 3 appears today only in the proposed FAR CUI rule for civilian contracts.
What changed in Revision 3?
- Families: NIST added three families, Planning, System and Services Acquisition, and Supply Chain Risk Management, for 17 in total.
- Count: Revision 3 has 97 requirements, down from 110, because NIST combined related requirements. NIST also added new requirements, so the lower count still includes new work.
- Parameters: Some requirements contain organization-defined parameters, which are values such as review frequency. The agency sets them, and the contractor assigns them if the agency does not.
Contractors can implement Revision 3 now if they use the DoW’s April 2025 parameters and close any gaps with Revision 2, since assessments still use Revision 2.
| Contract type | Revision that applies today | What changes it |
|---|---|---|
|
Defense contracts with DFARS 252.204-7012 |
Revision 2, under the class deviation |
DoW rulemaking that incorporates Revision 3 into 32 CFR part 170 |
|
Civilian agency contracts that involve CUI |
No Revision 3 mandate yet |
A final FAR CUI rule, which would require Revision 3 in proposed clause 52.240-7 |
|
Both defense and civilian contracts |
Revision 2 for defense work, with Revision 3 mapped alongside |
Whichever final rule arrives first |
The Proposed FAR CUI Rule & Civilian Agency Contractors
The proposed FAR CUI rule would extend protection and incident reporting requirements for Controlled Unclassified Information (CUI). The FAR Council published it in the Federal Register on June 23, 2026, comments closed July 23, but no effective date is set.
- Scope: Contracts where the contractor is expected to handle CUI, including commercial products and services other than commercially available off-the-shelf items, according to Wiley.
- Security: Systems that handle CUI would have to meet NIST SP 800-171 Revision 3, and cloud providers would need requirements equivalent to the FedRAMP Moderate baseline, the government’s cloud security standard.
- Reporting: CUI incidents would be reported within 72 hours of discovery, to CISA on civilian contracts, and subcontractors would report directly to the government.
- Gaps: An offeror that cannot meet every requirement at proposal would disclose the gaps and submit a plan of action and milestones (POA&M), a dated list of fixes that are planned to resolve them.
We found no third-party certification requirement in the notice, though attorneys quoted by CyberScoop expect the rule to expand False Claims Act exposure. They say a final rule could arrive by the end of 2026 or later.
CIRCIA Final Rule Still Pending
The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) is a 2022 law that requires owners and operators in critical infrastructure sectors to report major incidents to CISA within 72 hours and ransom payments within 24 hours.
CISA missed the October 2025 statutory deadline for the final rule, and CyberScoop’s October 2026 reporting still describes the CIRCIA rules as forthcoming. The Defense Industrial Base is one of the 16 critical infrastructure sectors, though whether your company counts as a covered entity depends on definitions that the final rule has yet to set.
The FAR proposal’s Revision 3 baseline sets up a comparison with the revision that DoD still uses, which the next section lays out.
Regulations Already in Effect, By Year
When a new year begins, the previous year’s items from the section above move here, and we add the new proposals to the top.
2026
Connecticut Data Privacy Act amendments.
The changes to the state privacy law took effect on July 1, 2026. The general threshold drops from 100,000 consumers to 35,000. Any organization that processes sensitive data or sells personal data is covered regardless of volume.
2025
DFARS CMMC rule and Phase 1.
The final DFARS rule that puts CMMC requirements into defense contracts took effect on November 10, 2025. Phase 1 made a Level 1 or Level 2 self-assessment a condition of award on contracts that include the clause.
January 2025 FAR CUI proposal.
The FAR Council first proposed a CUI rule on January 15, 2025, with an eight-hour reporting deadline. The June 2026 proposal replaced it after industry comments and moved the deadline to 72 hours.
2024
Class deviation and Revision 3.
DoW issued the Revision 2 class deviation on May 2, 2024, and NIST released Revision 3 on May 14, 2024. The deviation has no expiration date and, per the DoW CMMC FAQ, stays in place until Revision 3 is incorporated into the CMMC program rule. The CMMC program rule, 32 CFR part 170, took effect in December 2024.
2022 and 2023
CIRCIA.
The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) was signed into law by President Biden in March 2022 as Title II of the Strengthening American Cybersecurity Act (SACA). CIRCIA requires critical infrastructure companies to report cyber incidents to Cybersecurity and Infrastructure Security Agency (CISA) within strict timeframes. The final rule is still pending as of October 2026.
NIST SP 800-218 Secure Software Development Framework.
NIST wrote the framework in response to Executive Order 14028 of May 2021. It sets outcome-based secure development practices for companies that supply software to the federal government.
Federal and state privacy law.
The American Data Privacy and Protection Act was introduced in June 2022 and advanced out of a House committee, but Congress did not enact it. Connecticut signed its Data Privacy Act in May 2022, and the law took effect on July 1, 2023.
2019
Cybersecurity Maturity Model Certification (CMMC)
The Cybersecurity Maturity Model Certification (CMMC) was first announced by the Department of Defense (DoD) in June 2019 as a new assessment framework for DoD contractors and subcontractors that handle Federal Contract Information (FCI) and Controlled Unclassified Information (CUI). The framework aims to strengthen cybersecurity across the Defense Industrial Base – the 300,000 prime contractors and subcontractors. The compliance program continues to evolve.
