New ISOO Guidance Directs Federal Agencies To Provide More CUI Guidance To Contractors

What You Need to Know

• Key takeaway #1

  On September 2, 2026, the National Archives and Records Administration (NARA), through its Information Security Oversight Office (ISOO), released two new Notices on the topic of Controlled Unclassified Information (CUI).

• Key takeaway #2

  In part, the new ISOO guidance requires federal agencies to provide contractors with specific guidance“[f]or all contracts requiring access to CUI.”Some topics agencies must address include CUI identification, safeguarding requirements, and any processes for challenging CUI designations.

• Key takeaway #3

  CUI has been a persistent source of confusion for government contractors and their supply chains. This guidance should encourage federal agencies to clarify expectations for contractors before issues arise.

On September 2, 2026, the National Archives and Records Administration (NARA), through its Information Security Oversight Office (ISOO), released two new Notices on the topic of Controlled Unclassified Information (CUI): ISOO Notices 2026-07 and 2026-08.

CUI is a category of information that the federal government creates or possesses, or that an entity creates or possesses for or on behalf of the federal government, that requires safeguarding or dissemination controls but is not classified, per 32 CFR 2002.4(h).Federal government contracts often require contractors to implement heighted cybersecurity and physical security controls to safeguard CUI.Federal agencies are supposed to tell their contractors which contract-relevant information is CUI.In practice, however, contractors often find it difficult to determinewhat constitutesCUI.Additionally, contractual requirements for safeguarding and handling CUI often vary across programs and agencies, with inconsistent and sometimes unclear identification processes.

ISOO Notice 2026-07,Executive Agent Guidance for Implementation of the Controlled Unclassified Information Program, seeks to addresssome of these challenges.Neitherthis Notice nor its companion Notice regarding CUI waivers (2026-08) directly addresses or applies to contractors—both apply to federal agencies—but they may nevertheless benefit contractors.

Significantly, ISOO Notice 2026-07instructs agencies, “[f]or all contracts requiring access to CUI,” to provide, at a minimum, the following guidance to prime contractors:

• Identification of Specific Government-Furnished Information Designated as CUI;
• Process for identification of Contractor Developed Information as CUI;
• Process for CUI challenges;
• Training requirements and resources;
• Access requirements;
• Marking requirements;
• Safeguarding requirements;
• Decontrol and disposition requirements;
• Reporting requirements;
• Self-Inspection requirements;
• Process for reporting misuse of CUI; and
• Penalties for misuse of CUI.

ISOO Notice 2026-07 provides additionaldetail on several of these items. For example, the Notice instructs agencies to decontrol CUI in a timely manner when it no longer requires protection and to “include the identification of a specific decontrolling date or event with all CUI.” It also requires agencies to implement processes for the timelycommunication of CUI challenge decisions (i.e., decisions resolving challenges to CUI status).

Takeaways for Federal Government Contractors

This guidance is the latest indication that the government is seeking to make strides in more clearly communicating CUI handling requirements to their contractors. Earlier this summer, the FAR Council release an updated draft of the much-anticipated “FAR CUI Rule,” which calls for a new Standard Form that would itemize all CUI expected to be handled in contract performance. While comments on the proposed rule are considered, the new Notices couldserve as an immediate step toward clearer CUI expectations in contracts. As federal agencies begin to implement this guidance, contractors should consider affirmatively requesting the information it outlines.Obtaining this clarity in writing at the outset of a contractual relationship can help establish clear compliance obligations and minimize the risks of over- or under-protecting CUI.