Comment on FR Doc # 2026-12559

Comment on FAR Part 40 – Requirement to Report Unmarked or Mismarked CUI The proposed FAR Part 40 framework appropriately places responsibility on the Government to identify Controlled Unclassified Information (CUI) at the contract level, including through the use of a contract-specific Standard Form describing the nature of the information, applicable handling requirements, and system context. This is a necessary and welcome clarification that, if implemented consistently, should improve predictability and compliance. However, the proposed requirement that contractors report “unmarked, mismarked, or unidentified CUI” within 8 hours is inconsistent with that framework and should be removed or fundamentally revised. As drafted, the requirement effectively shifts responsibility for identifying CUI from the Government to the contractor. Determining whether information qualifies as CUI is not a ministerial task; it is a legal and policy determination tied to statutes, regulations, and governmentwide guidance. Contractors are neither positioned nor authorized to make such determinations independently, particularly within an 8-hour timeframe. More fundamentally, the requirement is at odds with the structure of the proposed rule itself. If the Government is responsible for identifying CUI and defining its scope under the contract, contractors must be entitled to rely on that designation. Imposing an obligation on contractors to identify and report potential errors in Government markings improperly converts the contractor into a backstop for Government classification decisions. This approach creates several concerns: 1. Improper Allocation of Responsibility: The Government is uniquely positioned to determine whether information meets the definition of CUI and how it should be marked. Shifting that responsibility to contractors is inconsistent with the proposed Standard Form regime. 2. Legal and Operational Uncertainty: Contractors would be required to make subjective determinations regarding whether information could qualify as CUI, without clear standards and under compressed timelines. 3. Increased Risk Without Control: Contractors could face compliance risk or liability based on failures in Government marking practices that are outside the contractor’s control. 4. Undermining the Purpose of the Rule: The proposed rule is intended to provide clarity and predictability in the handling of CUI. Requiring contractors to independently identify unmarked CUI undermines that objective and reintroduces ambiguity. Accordingly, the rule should be revised to make clear that: - The Government bears sole responsibility for identifying and marking CUI under the contract; - Contractors may rely on Government-provided markings and contract documentation (including the Standard Form) in determining whether information is CUI; and - Contractors are not responsible for identifying, reporting, or correcting unmarked or mismarked CUI provided by the Government. Establishing clear reliance principles would better align the rule with its stated objective of improving clarity, reduce unnecessary compliance burden, and ensure that responsibility for CUI determinations remains with the entity best positioned to make them.