Get tomorrow's brief in your inbox
Today: The FAR CUI proposed rule mandating NIST SP 800-171 rev 3 across all federal contracts is expected to enter contracts before year-end, DOJ settled a $2.5M PPP fraud case with a Virginia company, and the Army's Project Griffin is seeking AI cyber defense agents that won't create new vulnerabilities or rack up token costs.
FAR CUI Rule: Government-Wide NIST 800-171 Rev 3 Mandate Coming Before Year-End
The FAR CUI proposed rule, published in 2025 and folded into the Revolutionary FAR Overhaul, is expected to enter federal contracts before the end of 2026. This is not another DoD-only requirement. The rule creates a government-wide contract clause requiring NIST SP 800-171 rev 3 compliance for the protection of Controlled Unclassified Information (CUI) across all 19 civilian agencies represented in the Civilian Agency Acquisition Council, including Agriculture, Commerce, Education, Energy, HHS, DHS, Justice, VA, and others.
Action required: DoD contractors will now be responsible for both NIST 800-171 rev 2 (the baseline for CMMC assessments under 32 CFR 170) and rev 3 compliance (for FAR CUI contracts). Rev 3 has fewer top-level requirements than rev 2, but NIST 800-171A rev 3 (the assessment procedures) includes a 32% increase in verification questions. Contractors holding or pursuing civilian agency contracts must begin gap analysis now. Update your System Security Plan (SSP) to address rev 3 controls, faster 8-hour incident reporting timelines, standardized CUI identification, and FedRAMP Moderate cloud requirements. Brief leadership on the dual-standard compliance burden and budget for dual assessments if you work both DoD and civilian contracts. Summit 7 analysis
Virginia Company Pays $2.5M to Settle PPP Fraud Allegations
EBI LLC, a Virginia company based in Charlottesville, agreed to pay $2,541,742.12 to resolve allegations that it fraudulently obtained a Paycheck Protection Program loan from the Small Business Administration for which it was not eligible. The settlement reflects DOJ's continued scrutiny of COVID-era relief fraud. DOJ press release
FCA risk note: During the CMMC Phase 2 suspension, self-attestation plus the False Claims Act is the enforcement center of gravity. DOJ continues prosecuting fraud in adjacent SBA programs; expect the same rigor applied to contractors self-certifying NIST 800-171 compliance or CMMC readiness. If your SPRS score or self-assessment is inaccurate, fix it before a qui tam relator or a prime contractor audit surfaces the gap.
See FAR CUI item above. NIST SP 800-171 rev 3 is the standard of record for the FAR CUI rule. No other NIST guidance changes were reported today.
FAR CUI Flow-Down to All Federal Contracts
When the FAR CUI rule enters contracts (expected before year-end 2026), prime contractors across civilian agencies will flow down NIST 800-171 rev 3 requirements to subs handling CUI, mirroring what DIB contractors already face under DFARS 252.204-7012. Expect primes to begin auditing sub compliance against rev 3 controls even before the rule is finalized, and expect SAM.gov solicitations to start citing the clause in late 2026. Review your proposals and teaming agreements now to flag rev 3 compliance costs and timelines.
Army Project Griffin: AI Cyber Defense Without Token Bloat or New Vulnerabilities
The Army's defensive cyber warfare arm is piloting AI agents (Project Griffin, IRON capability) to ingest sensor feeds and autonomously execute defensive actions against cyber threats. The solicitation warns industry: token costs must be manageable, and agents cannot increase the attack surface. "If you guys are presenting things to us from a pilot perspective and it looks great, but then you guys are going to have an inflated cost at the end, we're gonna have a problem with that," said Wayne Sok, product manager. DefenseScoop coverage
DIB takeaway: Autonomous AI cyber defense is coming to DoD networks. If you're a managed service provider or software vendor targeting DoD, budget and architecture matter as much as capability. The Army is explicitly warning against solutions that rack up token charges or introduce new vulnerabilities. Use this as a design constraint for any AI-driven compliance, monitoring, or incident response tools you're building or deploying.
CISA Logging Guidance: Voluntary, But Expect Prime Flow-Down
CISA issued guidance for agencies to improve cybersecurity data logging. The guidance is voluntary for civilian agencies, but DIB contractors should expect primes to fold logging requirements into flow-down language, especially on contracts involving incident detection and response. Federal News Network item
Navy SECNAV Warning: Multi-Domain Campaign Targeting Personnel and Installations
Acting Secretary of the Navy Hung Cao issued an administrative message warning of a "coordinated, multi-domain campaign" against DoN personnel, civilians, and installations, including doxing, drone surveillance of ships and flight lines, physical probes of access control points, and cyber threats. Cao directed personnel to harden social media profiles, remove info connecting them to DoN, and report suspicious activity. DefenseScoop coverage
Contractor impact: If you support Navy contracts or operate near Navy installations, this is a force protection and OPSEC reminder with compliance implications. Review your security awareness training to cover social media hygiene, doxing risk, and reporting procedures for surveillance or suspicious contact. Update your Insider Threat Program if you have one, and brief employees on the threat environment.