Last Chance to Influence the FAR CUI Rule

Summary

Podcast Summary: Sum IT Up: CMMC News Roundup
Episode Title: Last Chance to Influence the FAR CUI Rule
Date: July 9, 2026
Host: Summit 7
Main Speakers: (A) and (B)

---

Episode Overview

This episode zeroes in on the Federal Acquisition Regulation Controlled Unclassified Information (FAR CUI) rule, which is nearing the end of its public comment period (closing July 23, 2026). The hosts break down the impending impact of this rule on all federal contractors—not just those handling defense contracts. They aim to guide listeners, especially affected businesses, on how to submit effective, persuasive public comments that can shape the final regulation. The tone is engaging, occasionally humorous, but always practical.

---

Key Discussion Points & Insights

1. The Impending FAR CUI Rule: What’s at Stake?

• The FAR CUI rule will broadly extend NIST SP 800-171 requirements to all federal contractors by end of 2026.
• Key change: Contractors must protect CUI per NIST SP 800-171, Revision 3 (not Revision 2).
• Introduction of a new standardized form to notify contractors exactly what CUI they’re protecting—met by the hosts with sarcastic excitement.

“I have never been more excited for a new standardized form than this one… the messy of standardized forms, if you will.”
— A (00:28)

2. FedRAMP Moderate Equivalency and Regulatory Inconsistencies

• Despite an ongoing overhaul, FedRAMP moderate equivalency requirements remain embedded in the proposed rule.
• The government’s lack of internal coordination (left hand vs. right hand) leads to conflicting and overlapping regulatory requirements.

“The left hand does not talk to the right hand inside the government. The FAR CUI rule is no exception.”
— A (02:32)

3. Effectiveness of Public Comments: Quality Over Quantity

The GSA's Rulemaking Commenters Checklist

The hosts run through a seven-step checklist—based on GSA best practices—for crafting public comments that actually influence outcomes:

Step 1: Understand the Regulation

• Read the rule itself, not secondary summaries.
• Avoid reliance on headlines, blogs, social media, or AI-generated summaries.

“A common mistake...people make is they just read headlines about the rule...rather than reading the rule for themselves.”
— A (03:45)

Step 2: Comment Where You Have Experience

• Focus on sections you deeply understand or can support with evidence.

Step 3: Be Specific

• Cite the exact section, page, or paragraph.
• Vague comments get misdirected or dismissed.

“Be specific about the thing that you are commenting on...identify the section, the page, the column, the paragraph, the sentence, the individual word that you have an issue with.”
— A (06:32)

Step 4: Make Clear Recommendations

• Don’t just oppose—propose better alternatives or specific solutions.
• Agency objectives are often statutory and must be met; suggest how to do so better.

“A comment without a recommendation is just empty and will not go anywhere whatsoever.”
— B (09:14)

Step 5: Support With Evidence & Reasoning

• Include real-world impacts, data, or analysis.
• General statements like “this is too expensive” need cost breakdowns and explanations.

“The most useful comments explain real world effects…challenge or support the assumptions that the agency [is] making.”
— A (09:54)

Step 6: Address Trade-Offs and Opposing Views

• Acknowledge the agency’s intent, note pros/cons, and discuss unintended consequences.

“There are costs and benefits to regulations by definition. So does your alternative version or improvement or change fix those trade offs in a more beneficial way?”
— A (12:52)

Step 7: It’s Not a Vote—Quality Beats Quantity

• One strong, well-supported comment is more effective than thousands of form letters.
• Flooding with mass-produced or shallow comments only slows the process down.

“The volume of comments doesn't matter, right? A single super effective comment is more effective than like a thousand comments that don't propose anything...”
— A (13:40)

---

Notable Quotes & Memorable Moments

• On Standardized Forms:
  “The messy of standardized forms, if you will.” — A (00:36)

• On Misguided Comments:
  “People will say stuff like, ‘this will be expensive,’...Right. So saying it will be expensive. Might be true, but what's the evidence? What's the impact?” — A (10:09)

• On the Comment Process:
  “This is my favorite item. The government is attempting to formulate the best policy to solve a problem...the volume of comments doesn't matter…” — A (13:39)

• On Submission Deadlines:
  “Don’t wait until the last minute. The comment period closes at 11:59 Eastern Time on the date that comments are due. Just like submitting your paper in college…” — A (15:47)

• On the New Form:
  “Can't wait to see the SF XXX form. Let's be honest.” — B (16:39)

---

Timestamps for Key Segments

• 00:00–01:40: Overview of the pending FAR CUI rule and its implications for all federal contractors.
• 01:41–02:32: Discussion of regulatory overlap and FedRAMP issues.
• 02:32–04:35: Explanation of this being the final public comment window; begin GSA’s commenter checklist.
• 04:35–07:44: Tips 1–3—Understanding the rule, focusing on expertise, and specificity in comments.
• 07:44–11:15: Tips 4–5—Providing recommendations and evidence.
• 11:15–13:39: Tips 6–7—Addressing trade-offs and emphasizing quality comments over quantity.
• 15:31–16:54: Final tips, urgency about submission deadline, and humorous closing on standardized forms.

---

Tone & Style

• The episode is practical, direct, and occasionally tongue-in-cheek; it balances policy seriousness with accessible humor.
• The hosts stress empowerment—anyone can comment effectively if they follow the right approach.

---

Final Takeaways

• Read the rule yourself, comment on what you know, be specific, recommend solutions, and support with evidence.
• Avoid flooding with form letters; quality, not volume, shapes policy.
• Don’t procrastinate—comments are due July 23, 2026, and this round may be the last chance to influence this significant regulatory change.

---

Useful Links:

• The episode promises a link to the GSA Commenters Checklist for further direction (not included in transcript).

---

This summary delivers a clear guide to the episode’s content and actionable insights for federal contractors facing upcoming compliance changes.

Transcript

[A]

All right, folks, It's July of 2026, and public comments on the FAR CUI rule are due on the 23rd in two weeks. The same cyber requirements that defense contractors have wrestled with for the last 10 years are coming for all federal contractors probably by the end of 2026. Do you support what's in this rule? Do you want to change what's in the rule? Well, you can have an impact on regulatory decision making through the magic of public comments, but only if those comments are effective. And that's what we're going to talk about today. Jason, good news and bad news about the FAR CUI rule. The good news, the government has to notify you about what CUI you are protecting via a new standardized form. I have never been more excited for a new standardized form than this one. Out of the many, many standardized forms in the hall of fame, this one is going to be at the top. The messy of standardized forms, if you will. The bad news, the bad news you need to protect CUI via NIST Special Publication 800 171, Revision 3, rather than Revision 2. Red alert defense contractors. Meanwhile, Fedramp Moderate Equivalency shows up again, even though the entire Fedramp program is being completely overhauled. So there's a lot of comments to be made. There's not a lot of time left to make them. And simply stating that you support this or that you oppose it is just not persuasive.

[B]

It's not going to be enough for you to make sure that things are easily manageable either. Because in typical government fashion, complete clarity offered for one specific rule or regulation, kind of without the consideration or the measures in place to make sure complexities aren't issued in other regulations. Which is what exactly? Our audience base, hopefully it's broader than that by now, is going to experience variances in cloud protection standards, variances in framework implementation, variances in reporting in certain ways. Right. And so with that being said, this is the last hope for those people that are impacted to put together a good argument to say that this is going to be worse for us than better for the security it's going to provide and see if any changes come, right?

[A]

Yeah, absolutely. The left hand does not talk to the right hand inside the government. The FAR CUI rule is no exception. We've done probably 12 episodes on the FAR CUI rule over the years, but as of right now, this, as far as we know, is the last chance that you will have to comment on this thing before it goes final. Before the end of this Year. So let's get into some of the tips that are directly from the GSA rulemaking program. Manage management offices commenters checklist for things that you can do to craft effective public comments. Not just for the FAR CI rule, but all the future rule making that we get to prioritize, participate in, which is just, just, just the best time ever. Okay, starting off here. First, start by understanding the regulation. This seems self obvious, but we really cannot stress this enough. Absolutely anyone can comment on a proposed regulation. It is a miracle of transparent government and regulatory systems that you can just comment on it and they have to address your comment as long as it is substantive. You don't have to be an expert or an academic, but you do need to be familiar with what you're commenting on. Right? So read the proposal, read the preamble, read the agency's questions, definitions, their cost analysis, their deadlines, their cited authorities. Read the rule before you start writing comments and critiques and suggestions for how to change it. A common mistake that people make is they just read headlines about the rule. They just read summaries about the rule. They read blogs about the rule, they read social media posts, God forbid about rulemaking rather than reading the rule for themselves. These days they should probably update their commenters checklist. Be careful about using AI summaries of complicated and subtle rules before you start making suggestions on how to change it. So read it for yourself. Take the time to do it. You know, this is really the first and most important thing people can do.

[B]

Yeah. Speculation and kind of guidance from unauthorized resources will drive obviously the will be the seed for a terrible comment. In addition to that, would the thing that falls in line with this kind of be make sure that the comment that you're making is applicable to the party in which you're making it to.

[A]

Right.

[B]

Like it. Don't go and say that I want to change this part of the rule and regulation and it's not for the party that you're commenting to about the rule, right?

[A]

Yeah, absolutely. All right, next tip here, Comment on the issues that you understand best. You don't have to comment on every issue in the rule, every part of the rule, every detail of the rule. Pick the provision of the rule where you have relative experience or where you have useful evidence. The FAR CUI rule is buried in a huge proposal that includes multiple parts of the far. It's absolutely massive. This is all part of the revolutionary FAR overhaul. The FAR CUI rule itself, the actual clause itself, it's like a page. It's not Very long. But it's buried in this huge tranche of rules all together as one thing. You don't have to comment on all that stuff. You don't even have to comment on all the parts of the far CUI rule itself. There might be one thing that you're like, hey, change this. Hey, you got this wrong. Hey, add this. Whatever you think, common mistake that people make, they write sort of broad, shallow comments on everything in the rule, rather than any kind of focused or persuasive comment on just one or two or a few important issues.

[B]

Yeah, well, it's always best to talk about the things that you understand the best. Right. And especially for some of the other steps in formulating a good comment that we'll talk about later on in the show, this is particularly relevant because to establish the premise for all of those other steps, this is very important. You have to know what you're talking about, and you have to know how to address what you're talking about.

[A]

Yeah, yeah. So be specific. Which brings us to number three here. Cite the exact part of the rule that you are addressing. It's a lot for you to dig through. It's also a lot for them to have to manage because people are making comments across these huge documents. So identify the section, the page, the column, the paragraph, the sentence, the individual word that you have an issue with, definitions, questions you're responding to, makes it way, way easier for reviewers to connect what you're commenting on to the specific record in the regulation. Common mistake that people make here. They just say stuff like, the reporting requirement in the far CUI rule is unrealistic. Which reporting requirement is it the deadline? Is it the definition that triggers the report? Is it the data elements that you have to report? Be specific about the thing that you

[B]

are commenting on, and then that will also allow for the assigning to the proper person to address the comment. Right. Like if you're, I guess, exact in the nature of where you want to attack, it might be a different person responsible for addressing it. Wherein if you, you, you're not specific enough, it may go to the wrong person and be dismissed.

[A]

Yeah. It also takes a lot longer for them to have to try to connect it. And we all want the rulemaking process to go faster. So the best way to make it go faster is to make better, more concise, more effective comments to help them along their merry way here. All right, number four, make a clear recommendation or recommendations and explain why it's better. So if you disagree with something that's proposed, propose an Alternative, revise the language, clarify a term, extend a timeline, narrow scopes, add exceptions, require a less burdensome data set for reporting. For example, you know, the recommendations should identify specific changes and offer ways to solve the agency's specific problem. That the government is trying to solve a problem here. And so ways to improve how they solve that problem is really what they're looking for rather than just saying this is bad. Right. Or you got it wrong or I disagree. Right. We're trying to be constructive here in order to get the, the policy shaped the way that you want. So common mistake is people will just say withdraw the rule, don't do the rulemaking, just don't regulate it at all. Zero explanation of how the agency should actually meet their objective. Because a lot of times these objectives are statutory requirements. They have to issue a rule in order to solve this problem. So just saying don't do this doesn't solve the problem.

[B]

Yeah. So one of the most foundational things I think that I've learned from you in, in this entire process is the fact that a comment without a recommendation is just empty and will not go anywhere whatsoever. And what we have to understand is, is that what's being presented in regulation is the establishment of risk acceptance on the level of the authority body that's issuing it. Right. And so if you are making a recommendation for them to change that you need to come, or if you are telling them that what they, they've determined is acceptable needs to change, then come up with something that's going to make it more acceptable and within the appetite. Right?

[A]

Yeah. Yeah. So a good example here is tip number five. So support port your comment, your specific, detailed comment on a specific part of the rule with reasoning, evidence and impact. Right. Would your English teacher give you an A on this, on this argumentative essay that you're writing right now? So the most useful comments explain real world effects and they challenge or support, you know, depends on which side of the, which side of the issue you're on. They challenge or support the assumptions that the agency are making. So you can provide technical data, you can provide economic data, scientific data, experience based information. This can be qualitative, it can be quantitative wherever possible. But you have to support your comment with reasoning, evidence and impact to form a complete argument. Common mistake, very common mistake that we have seen over the years. People will say stuff like this will be expensive or this will be too expensive without estimating the cost or explaining what that burden means or describing where that cost goes or any of the details. Right. So saying it Will be expensive. Might be true, but what's the evidence? What's the impact? What's the alternative? What should they do with the information rather than just saying it costs money. They know it costs money.

[B]

This ties into the second point that we made is speaking of things in which you're familiar with that you can relate to. Being able to provide this type of evidence is what makes the foundations of a great comet experience. The analysis, the ability to know what analysis to include things of that nature. It's all foundational.

[A]

Great example of this. The 32 CFR CMMC program rule originally didn't estimate the cost of having a managed service provider provide services that are billed hourly in their cost estimates. Based on public comments, they included those costs in the final rule. Are they perfectly accurate? Probably not. But they're a lot closer than they were in their original proposed rule. So, you know, we're all working together here. We're all working together here. Okay, item number six, address trade offs and opposing views. The difference between high school essay and a good graduate level essay is complicating your thesis, right? We're not submitting graduate level essays here. But you know, we gotta, we gotta try. Everybody, we gotta try. So a strong public comment. Remember, this is not our opinion. This is from GSA's public comment rulemaking program office. Their list of tips which we'll link below. They say that a strong comment acknowledges the agency's goal and explains the pros, the cons, the unintended consequences and why your proposed approach or your proposed alternative to better balances the problem that the agency is trying to solve. Right. So common mistake that people make is they pretend that there's no benefit to the proposed regulation or that you can just ignore the problem and the agency doesn't have to do anything at all. Right. Those are not going to get us anywhere. There's always trade offs. That famous quote. There's no, there's no such thing as a solution. There's only trade offs. There are costs and benefits to regulations by definition. So does your alternative version or improvement or change fix those trade offs in a more beneficial way?

[B]

Is your problem greater than mine and greater than the problem that it presents to me in the hole that this addresses? Right. And how can you defend that?

[A]

Yeah, absolutely. All right, last item here. What do you know? Seven items. Seven items. It's pretty crazy. We'll link to the list below. They have some really great explanations on there. Should definitely read those. It's worth your time. Couple comment things.

[B]

Very important.

[A]

But seventh item Here the comment process is not a vote. This is my favorite item. The government, yeah, the government is attempting to formulate the best policy to solve a problem. So when crafting your comments, it's important that you explain the reasoning behind your position and not commit the common mistake of thinking that submitting lots of comments by lots of people will somehow sway their opinion. The volume of comments doesn't matter, right? A single super effective comment is more effective than like a thousand comments that don't propose anything, aren't specific, don't provide any evidence, so on and so forth. Super common mistake. That happens a lot. People think that industry group form letters that they can submit en masse will constitute some sort of a collective vote regarding the issue in the rule. And that you're like, well, more people submitted comments saying they don't like it than people who submitted comments saying that they do like it. Therefore the, the disagree votes win. Not how it works. It's not how it works. The quality of your reasoning, your argumentation, your evidence, your proposal, weighing the alternatives and giving the agency a path forward is what will dictate how they shape the policy if they decide to.

[B]

Realistically, if you just decide to flood the inbox with the same comment thinking it's going to get more attention, all you do is slow down the process, put it in mud, because it's more comments that need to get reviewed. If you're going to put one together as an industry. Right. Industry group, just make sure that it's well formulated with a lot of evidence and a lot of opinions attached to it so that it, it's, it's the mark, right? Whatever point you're trying to get across, make sure it's a great comment, not more of one average comment.

[A]

Yeah, just a bunch of people saying I don't like it isn't really going to do anything. One person saying I don't like it for the following reasons. You missed this. Here's a better alternative and you should do it because it's blah, blah, blah, blah, way, way more effective. And that could just be a single one. So take your time. All right, wrapping up here at the end. Definitely read the commenters checklist, which we will link below. It's a lot of great information and it's universal across submitting public comments on all kind different rules and regulations. Last tip though, don't wait until the last minute. The comment period closes at 11:59 Eastern Time on the date that comments are due. Just like submitting your paper in college, right everybody? So begin work before the deadline. Get familiar with the reading before the deadline. Don't rely on the summaries. Craft your your comments according to these guidelines. Get them submitted early so you don't miss out. There's only 30. They only provided 30 days of public comments on this rule. So that's going to fly by and it's already half over. It's going to fly by in the blink of an eye. Hopefully we see the final far CUI rule before the end of the year. So the last, last chance to comment on it.

[B]

Can't wait to see the SF XXX form. Let's be honest.

[A]

Yeah, it'll I, I eventually it'll actually have a number instead of just being triple X. But that's for another episode, yet another episode on the far CI rule and it's finally out everybody. There you go. Like and subscribe. We'll see you next week.

[B]

See you next week.