Comment on FR Doc # 2026-12559
QuoraraSupportBusiness
Summary: Quorara, a software and advisory services provider for federal contractors, supports the proposed governmentwide standard for safeguarding Controlled Unclassified Information (CUI) and its consolidation into FAR Part 40. However, they recommend specific improvements to address implementation issues, including resolving the divergence between NIST SP 800-171 revisions, establishing a tiered phase-in period, defining a diligence standard for CUI compliance attestation, and providing governmentwide defaults for organization-defined parameters.
Please see the attached comment of Quorara Cyber on FAR Case 2026-001 (Docket No. FAR-2026-0001), addressing the proposed CUI requirements in FAR Part 40. Our comments concern six implementation issues: the NIST SP 800-171 Rev. 3 / Rev. 2 divergence with DoD requirements, the absence of a phase-in, the absence of a defined diligence standard for CUI compliance attestation, organization-defined parameters, FedRAMP-Moderate equivalency, and the CUI identification form.