Major rules for federal contractors handling sensitive data are nearing the finish line

What happened

The regulations on “controlled unclassified information” include security rules and requirements for reporting when they’re breached, including by cyberattacks. As currently written, the proposed CUI rules mandate that unauthorized access of such data, including as a result of a cyberattack, would have to be reported to the federal government within 72 hours of discovery.

Federal government contractors that handle sensitive information could soon face a “sea change” in rules about how they protect that information and report when it has been part of a breach. The changes are part of a larger overhaul of federal contracting rules. The rules are a companion for most federal agencies to existing Defense Department rules that cover the same subject.