Last Chance to Influence the FAR CUI Rule

All right, folks. It’s July of 2026 and

public comments on the FARC CUI rule are

due on the 23rd in two weeks. The same

cyber requirements that defense

contractors have wrestled with for the

last 10 years are coming for all federal

contractors probably by the end of 2026.

Do you support what’s in this rule? Do

you want to change what’s in the rule?

Well, you can have an impact on

regulatory decision-making through the

magic of public comments, but only if

those comments are effective. And that’s

what we’re going to talk about today.

Jason,

good news and bad news about the FARCUI

rule. The good news, uh, the government

has to notify you about what CUI you are

protecting via a new standardized form.

I have never been more excited for a new

standardized form than this one. Out of

the many, many standardized forms in the

Hall of Fame, this one is going to be at

the top. The messy of standardized

forms, if you will. The bad news, the

bad news, you need to protect CUI via

NIST special publication 8001 171

revision three rather than revision two,

red alert, defense contractors.

Meanwhile, Fed Ramp moderate equivalency

shows up again. Even though the entire

Fed Ramp program is being completely

overhauled. So, there’s a lot of

comments to be made. There’s not a lot

of time left to make them. And simply

stating that you support this or that

you oppose it is just not persuasive.

It’s not going to be enough for you to

make sure that things are easily

manageable either because in typical

government fashion, complete clarity

offered for one specific uh rule or

regulation uh kind of without the uh

consideration or the measures in place

to make sure complexities aren’t issued

in other regulations, which is what

exactly our uh audience base hopefully

it’s broader than that by now is going

to experience. uh variances in cloud

protection standards, variances in

framework implementation, variances uh

in reporting in in certain ways, right?

And so with that being said, this is the

last hope for those people that are

impacted to put together a good argument

to say that this is going to be worse

for us than better for the security it’s

going to provide and see if any changes

come, right?

Yeah, absolutely. The left hand does not

talk to the right hand inside the

government. The FARCUI rule is no

exception. We’ve done probably 12

episodes on the FARC CUI rule over the

years, but as of right now, this, as far

as we know, is the last chance that you

will have to comment on this thing

before it goes final before the end of

this year. So, let’s get into uh some of

the tips that are directly from the GSA

rulemaking program manage management

offices commenters checklist for things

that you can do to craft effective

public comments not just for the FARCY

rule but all the future rule making that

we get to participate in uh which is

just just the best time ever. Okay,

starting off here first start by

understanding the regulation. Uh this

seems self-obvious but we really cannot

stress this enough. Absolutely anyone

can comment on a proposed regulation. It

is a miracle of transparent government

and regulatory systems that you can just

comment on it and they have to address

your comment as long as it is

substantive. You don’t have to be an

expert or an academic but you do need to

be familiar with what you’re commenting

on. Right? So read the proposal, read

the preamble, read the AY’s questions,

definitions, their cost analysis, their

deadlines, their cited authorities. Read

the rule before you start writing

comments and critiques and suggestions

for how to change it. A common mistake

that people make is they just read

headlines about the rule. They just read

summaries about the rule. They read

blogs about the rule. uh they read

social media posts, god forbid, about

rulemaking rather than reading the rule

for themselves. These days, they should

probably update their commenters

checklist. Be careful about using AI

summaries of complicated and subtle

rules before you start making

suggestions on how to change it. So,

read it for yourself. Take the time to

do it. Uh you know that this is really

the first and most important thing

people can do.

Yeah. speculation and kind of guidance

from unauthorized resources will drive

obviously the will be the seed for a

terrible comment. In addition to that,

would the thing that falls in line with

this uh kind of be make sure that the

comment that you’re making is applicable

to the party in which you’re making it

to, right? like it. Don’t go and say

that I want to change this part of the

rule or regulation and it’s not for the

party that you’re commenting to about

the rule. Right.

Yeah. Absolutely. All right. Next tip

here. Comment on the issues that you

understand best. You don’t have to

comment on every issue in the rule,

every part of the rule, every detail of

the rule. Pick the provision of the rule

where you have relative experience or

where you have useful evidence. Uh the

FAR CUI rule is buried in a huge

proposal that includes multiple parts of

the FAR. It’s absolutely massive. This

is all part of the revolutionary FAR

overhaul. The FARC cui rule itself, the

actual clause itself, it’s like a page.

It’s it’s not very long, but it’s buried

in this huge trunch of rules all

together as one thing. You don’t have to

comment on all that stuff. You don’t

even have to comment on all the parts of

the FARCUI rule itself. There might be

one thing that you’re like, “Hey, change

this. Hey, you got this wrong. Hey, add

this.” Whatever you think. Common

mistake that people make. They write

sort of broad, shallow comments on

everything in the rule rather than any

kind of focused or persuasive comment on

just one or two or a few important

issues.

Yeah. Well, it’s always best to talk

about the things that you understand the

best, right? And especially for some of

the other steps in formulating a good

comment that we’ll talk about um later

on in the show. Uh this is particularly

relevant because to establish the

premise for all of those other steps, uh

this is very important. You have to know

what you’re talking about and you have

to know how to address what you’re

talking about.

Yeah. Yeah. So be specific. Which brings

us to number three here. Cite the exact

part of the rule that you are

addressing. It’s a lot for you to dig

through. It’s also a lot for them to

have to manage because people are making

comments across these huge documents. So

identify the section, the page, the

column, the paragraph, the sentence, the

individual word that you have an issue

with. Definitions, questions you’re

responding to. Makes it way, way easier

for reviewers to connect what you’re

commenting on to the specific record in

the regulation. Common mistake that

people make here, uh, they just say

stuff like the reporting requirement in

the FARCI rule is unrealistic. Which

reporting requirement? Is it the

deadline? Is it the definition that

triggers the report? Is it the data

elements that you have to report? Be

specific about the thing that you are

commenting on.

And then that will also allow for the

assigning to the proper person to

address the comment, right? Like if

you’re um I guess exact in the nature of

where you want to attack, it might be a

different person responsible for

addressing it wherein if you you’re not

specific enough, it may go to the wrong

person and be dismissed.

Yeah. It also takes a lot longer for

them to have to try to connect it. And

we all want the rulemaking process to go

faster. So, the best way to make it go

faster is to make better, more concise,

more effective comments to help them

along uh their merry way here. All

right. Number four, make a clear

recommendation or recommendations and

explain why it’s better. So if you

disagree with something that’s proposed,

propose an alternative, revise the

language, clarify a term, extend a

timeline, narrow scopes, add exceptions,

require a less burdensome data set for

reporting. For example, you know, the

recommendations should identify specific

changes and offer ways to solve the AY’s

specific problem that the government is

trying to solve a problem here. And so

ways to improve how they solve that

problem is really what they’re looking

for rather than just saying this is bad,

right? Or you got it wrong or I

disagree, right? We’re trying to be

constructive here in order to get the uh

the policy shaped the way that you want.

So common mistake is people will just

say withdraw the rule, don’t do the

rulemaking, just don’t regulate it at

all. zero explanation of how the agency

should actually meet their objective

because a lot of times these objectives

are statutory requirements. They have to

issue a rule in order to solve this

problem. So just saying don’t do this

doesn’t solve the problem.

Yeah. So one of the most foundational

things I think that you I’ve learned

from you in in this entire process is

the fact that it a comment without a

recommendation is just empty and will

not go anywhere whatsoever. And what we

have to understand is is that what’s

being presented in regulation is the

establishment of risk acceptance on the

level of the authority body that’s

issuing it. Right? And so if you are

making a recommendation for them to

change that, you need to come or if you

are telling them that what they they’ve

determined is acceptable needs to

change, uh then come up with something

that’s going to make it more acceptable

and within the appetite, right?

Yeah. Yeah. So a good example here uh is

tip number five. So support your

comment, your specific detailed comment

on a specific part of the rule with

reasoning, evidence, and impact. Right?

uh would your English teacher give you

an A on this uh on this argumentative

essay that you’re writing right now? So,

the most useful comments explain real

world effects and they challenge or

support, you know, depends on which side

of the which side of the issue you’re

on, they challenge or support the

assumptions that the agency are making.

So, you can provide technical data, you

can provide economic data, scientific

data, experience-based information. This

can be qualitative, it can be

quantitative uh wherever possible. But

you have to support your comment with

reasoning, evidence and impact to form a

complete argument. Common mistake, very

common mistake that we have seen over

the years. People will say stuff like

this will be expensive or this will be

too expensive without estimating the

cost or explaining what that burden

means or describing where that cost goes

or any of the details. Right? So saying

it will be expensive might be true, but

what’s the evidence? What’s the impact?

What’s the alternative? What should they

do with the information rather than just

saying it costs money? They know it

costs money.

This ties into the second point that we

made is uh speaking on things in which

you’re familiar with that you can relate

to. Uh being able to provide this type

of evidence is what makes the

foundations of a great comet.

experience, uh, the analysis, the

ability to know what analysis to

include, things of that nature. It’s all

foundational.

Great example of this, the 32 CFR CMMC

uh, program rule originally didn’t

estimate the cost of having a managed

service provider provide services that

are build hourly in their cost

estimates. Based on public comments,

they included those costs in the final

rule. Are they perfectly accurate?

Probably not, but they’re a lot closer

than they were in their original

proposed rule. So, you know, we’re all

working together here. We’re all working

together here. Okay. Item number six,

address tradeoffs and opposing views.

The difference between high school essay

and a good graduate level essay is

complicating your thesis. Right? We’re

not submitting graduate level essays

here, but you know, we got to we got to

try everybody. We got to try. So, a

strong public comment. Remember, this is

not our opinion. And this is from GSA’s

public comments rulemaking program

office, their list of tips, which we’ll

link below. They say that a strong

comment acknowledges the agency’s goal

and explains the pros, the cons, the

unintended consequences, and why your

proposed approach or your proposed

alternative better balances the problem

that the agency is trying to solve.

Right? It’s a common mistake that people

make is they pretend that there’s no

benefit to the proposed regulation or

that you can just ignore the problem and

the agency doesn’t have to do anything

at all. Right? Those are not uh going to

get us anywhere. There’s always

trade-offs. That famous quote, there’s

no there’s no such thing as a solution.

There’s only trade-offs. There are costs

and benefits to regulations by

definition. So, does your alternative

version or improvement or change fix

those trade-offs in a more beneficial

way?

Is your problem greater than mine and

greater than the problem that it

presents to me in the hole that this

addresses? Right. And how can you defend

that?

Yeah, absolutely. All right, last item

here. What do you know? Seven items.

Seven items. It’s It’s pretty crazy.

We’ll link to the list below. They have

some really great explanations on there.

You should definitely read those. It’s

worth your time. Public commenting is

very important. But seventh item here,

the comment process is not a vote. This

is my favorite item. The government

Yeah. The government is attempting to

formulate the best policy to solve a

problem. So when crafting your comments,

it’s important that you explain the

reasoning behind your position and not

commit the common mistake of thinking

that submitting lots of comments by lots

of people will somehow sway their

opinion. volume of comments doesn’t

matter, right? A single super effective

comment is more effective than like a

thousand comments that don’t propose

anything, aren’t specific, don’t provide

any evidence, so on and so forth. Super

common mistake that happens a lot.

People think that industry group form

letters that they can submit in mass

will constitute some sort of a

collective vote regarding the issue in

the rule. And then you’re like, well,

more people submitted comments saying

they don’t like it than people who

submitted comments saying that they do

like it. Therefore, the the disagree

votes win. Not how it works. It’s not

how it works. The quality of your

reasoning, your argumentation, your

evidence, your proposal, weighing the

alternatives, and giving the agency a

path forward is what will dictate how

they shape the policy if they decide to.

Realistically, if you just decide to

flood uh the inbox with the same

comment, thinking it’s going to get more

attention, all you do is uh slow down

the process, put it in mud because it’s

more comments that need to get reviewed.

If you’re going to put one together as

an industry, right, industry group, just

make sure that it’s well formulated with

a lot of uh evidence and a lot of

opinions attached to it so that it hits

hits the mark, right? Whatever point

you’re trying to get across, make sure

it’s a great comment, not more of one

average comment.

Yeah, just a bunch of people saying, “I

don’t like it,” isn’t really gonna do

anything. One person saying, “I don’t

like it for the following reasons. You

missed this. Here’s a better

alternative, and you should do it

because it’s blah blah blah blah blah.”

Way, way more effective. Uh, and that

could just be a single one. So, take

your time. All right, wrapping up here

at the end. Definitely read the

commenters checklist, which we will link

below. It’s a lot of great information

and it’s universal across submitting

public comments on all kinds of

different rules and regulations. Last

tip though, don’t wait until the last

minute. The comment period closes at

11:59 Eastern time on the date that

comments are due. Just like submitting

your paper in college, right, everybody?

So, begin work before the deadline. Get

familiar with the reading before the

deadline. Don’t rely on the summaries.

craft your uh your comments according to

these guidelines. Get them submitted

early so you don’t miss out. Uh there’s

only 30 they only provided 30 days of

public comments on this rule. So that’s

going to fly by in it’s already half

over. It’s going to fly by uh in the

blink of an eye. Hopefully we see the

final FARC cui rule before the end of

the year. So the last last chance to

comment on it.

Can’t wait to see the SFX form. Let’s be

honest. Yeah, it’ll I I eventually it’ll

actually have a number instead of just

being XX. But that’s for another

episode, yet another episode on the Far

Cy roll. And it’s finally out,

everybody. Uh there you go. Like and

subscribe. We’ll see you next week.

See you next week. [music]

[music]

[music]

[music]