For years, protecting Controlled Unclassified Information to the NIST 800-171 standard has mostly meant one audience: defense contractors, and the CMMC program built to enforce it. The proposed FAR CUI rule changes who’s on the hook. It would extend NIST SP 800-171 to every federal contractor that handles CUI, civilian agencies included, and once the clause lands in your contracts there’s no phase-in period to catch up.

What the FAR CUI rule actually does

The FAR Council published an updated proposed rule on 23 June 2026, with a comment period running to 23 July 2026, and it’s expected to be finalized before the end of 2026. It would require any contractor whose contract identifies CUI to implement NIST SP 800-171 Revision 3, and a limited set of contractors tied to critical programs or high-value assets would also face the enhanced controls of NIST SP 800-172. The headline here is the scope. This is no longer a Department of Defense requirement. It’s a whole-of-government one.

Why “we have CMMC handled” is not the same thing

If you already work with the DoD, CMMC has you thinking about NIST 800-171 through third-party assessment. The FAR CUI rule is the civilian counterpart, and it reaches contractors who have never touched CMMC because they sell to agencies outside defense. The control backbone is the same, but the audience is far larger, and a lot of the newly-covered contractors are starting from a standing stop. One difference cuts the other way. Where CMMC verifies you through a third-party assessor, the FAR CUI rule leans on self-attestation. That sounds lighter, but it just moves the burden of proof onto you, and a false attestation about your own security is not a small thing to sign. If you sell to any federal agency and touch CUI, the same obligations are coming for you. The DoD-specific view is in why CMMC wants you to test your incident response.

The part that is about your people, not your GRC tool

Most of NIST 800-171 is technical implementation, and a policy binder covers the paperwork. But two of its requirements are about human readiness, and those are the ones a document can’t fake. You have to train your people on their security roles, and you have to test your incident response capability, not just plan it. When a real CUI incident hits, the only question that matters is whether your team can actually run the response, inside the reporting deadlines, without opening the runbook for the first time.

What readiness looks like

It looks like the team running the incident, not narrating a plan. That’s what Malware & Monsters does. It’s a tabletop incident response game where the scenario changes because of what the team decides, so you’re exercising the capability the standard asks you to test, and building the instinct a real CUI incident will demand. There’s a nice overlap worth naming here: a tabletop exercise is one of the artifacts these rules expect you to be able to produce. Running the game both builds the capability and gives you the evidence that you tested it. It has been run with security teams across Europe and North America.

The FAR CUI rule isn’t final yet, but the direction is set and there’s no phase-in waiting for you. The contractors who are ready when the clause appears will be the ones who trained and tested before they had to. If your obligations sit on the European side of the Atlantic instead, the same readiness logic runs through EU cyber regulation training.

Frequently asked questions

What is the FAR CUI rule?

It is a proposed Federal Acquisition Regulation rule, updated on 23 June 2026, that would require federal contractors whose contracts involve Controlled Unclassified Information to implement NIST SP 800-171 Revision 3. The comment period runs to 23 July 2026 and it is expected to be finalized before the end of 2026.

Does the FAR CUI rule apply to non-defense contractors?

Yes, that is the change. It would extend the NIST 800-171 requirement from defense contractors to all federal contractors that handle CUI, across civilian agencies too.

When does it take effect?

It is still a proposed rule, expected to be finalized before the end of 2026. Notably, there is no phase-in: once the clause is inserted into a contract, compliance is required from that point.

How is the FAR CUI rule different from CMMC?

CMMC is the DoD-specific program that verifies NIST 800-171 compliance through a third-party assessment. The FAR CUI rule applies the same standard across the whole federal government but relies on contractor self-attestation rather than an external assessor. Same control backbone, different audience, different proof.

Want to put this in front of your team?

I run these as games your board and your responders actually take part in, not another slideshow. Tell me where your team is and what they need to practice, and we will set it up.

CMMC certification is how a company stays eligible for US Department of Defense contracts, and it asks for more than a binder of policies. To reach Level 2 you have to meet the practices in NIST SP 800-171, and two of them are about your people, not your paperwork. You have to train them, and you have to test your incident response capability. A slide deck and a filed plan satisfy neither one, at least not in the way an assessor actually checks.

What CMMC asks of your people

Level 2 aligns to the 110 practices of NIST SP 800-171, and sitting among the technical controls are a couple that are squarely about human readiness. The Awareness and Training family requires you to make your people aware of security risks and train them on their specific roles. The Incident Response family goes further than “have a plan”: practice 3.6.3 requires you to test the organizational incident response capability. Not document it. Test it. That’s a verb an auditor can ask you to evidence.

Why the checklist is the default

The checklist is the obvious answer, and for good reasons. A lot of CMMC is genuine technical implementation, and a self-assessment or a tabletop template produces the artifact a C3PAO assessor expects to see. If the goal were to show that an IR plan exists, the template would be enough. But the practice doesn’t ask whether a plan exists. It asks whether the capability works.

A tested capability is not a filed plan

An incident response plan nobody has run is a set of assumptions about how your team will behave during a breach involving controlled unclassified information. Who declares the incident. Who talks to the prime contractor and to the government. Whether the runbook still matches the systems you have now. You don’t find those gaps by reviewing the document, and neither does the assessor. You find them by running it under pressure, before a real incident and a real audit find them for you.

What testing your IR capability looks like

It looks like the team working a real incident, making the calls, and living with the consequences on the table instead of in production. That’s what Malware & Monsters does. It’s a tabletop incident response game where the scenario changes because of what the team decides, so you’re exercising the capability CMMC 3.6.3 asks you to test, not narrating a plan. It has been run with security teams across Europe and North America, and it sits in the wider serious games catalog alongside my other facilitated tabletop exercises.

CMMC is US defense contracting today, but the same NIST 800-171 backbone is about to reach every federal contractor under the proposed FAR CUI rule. The readiness problem is also exactly the one the EU is now legislating for its own entities. If you operate on both sides of the Atlantic, the EU equivalents are in game-based training for EU cyber regulation.

Frequently asked questions

Does CMMC require incident response testing?

Yes. CMMC Level 2 aligns to NIST SP 800-171, and practice 3.6.3 requires you to test the organizational incident response capability, not just document a plan.

Does CMMC require security training?

Yes. The Awareness and Training practices require you to make personnel aware of security risks and train them on their assigned security roles and responsibilities.

What is CMMC Level 2?

Level 2 is the Advanced level of CMMC 2.0, aligned to the 110 practices of NIST SP 800-171, required for contractors that handle Controlled Unclassified Information, and assessed by a third party for most.

Can a game help with CMMC compliance?

A game does not certify you, but it directly serves the human practices CMMC checks: it tests your incident response capability and trains your people on their roles, which is exactly what a tabletop like Malware & Monsters is built to do.

Want to put this in front of your team?

I run these as games your board and your responders actually take part in, not another slideshow. Tell me where your team is and what they need to practice, and we will set it up.

DORA made operational resilience testing a legal duty for financial entities across the EU, not an internal best practice. It expects a real testing program and business-continuity arrangements that actually work. Plenty of firms are handling that with a documented plan and a checklist. The document proves you have a plan. It proves nothing about whether the plan works, or whether the people who’d have to run it can.

What DORA actually requires

DORA isn’t a paperwork exercise dressed up as resilience. Article 11 requires ICT business continuity policies and response and recovery plans that are maintained and tested. Articles 24 to 26 require a program of digital operational resilience testing of your ICT systems, and for the larger entities, advanced threat-led penetration testing. The word doing all the work there is testing. DORA doesn’t ask you to have a continuity plan. It asks you to prove it holds up.

Why firms default to the checklist

The checklist is the obvious answer, and it’s obvious for good reasons. It’s auditable, it’s cheap, and it produces the artifact a supervisor asks for. If the goal were to show that a plan exists on paper, the checklist would be enough. That’s just not what DORA is testing for.

A plan you have never run is a hypothesis

A continuity plan that’s never been exercised is a set of assumptions about how people will behave in the worst hour of their year. Who makes the call to fail over. Whether the runbook still matches the systems you actually have now. Whether the business owner and the technical team even agree on what “recovered” means. You don’t find those gaps by reviewing the document. You find them by running it, under time pressure, before a real disruption finds them for you.

What resilience testing looks like when it works

It looks like the team running the plan, not reading it. You take your actual continuity plan, put it under a realistic disruption with a clock, and watch where it breaks. That’s what FAILOVER does. It’s a business-continuity exercise run against your real plan, not a generic case study, so the gaps you find are the gaps you actually have. It’s the difference between a plan you filed and a plan you trust.

DORA will keep raising the bar on what counts as testing, and a checklist was never going to tell you whether your organization can actually recover. Test the plan the way you’d test anything you depend on. Run it.

DORA is one of several EU regimes now demanding tested capability rather than filed documents. NIS2 makes the same move at board level, and the game-based approach across both sits in training for EU cyber regulation.

Frequently asked questions

Does DORA require operational resilience testing?

Yes. DORA Articles 24 to 26 require a program of digital operational resilience testing of ICT systems, and Article 11 requires ICT business continuity plans that are maintained and tested. Larger entities also face threat-led penetration testing.

Is a documented continuity plan enough for DORA?

No. DORA is explicit that plans must be tested, not just maintained. A documented plan satisfies the paperwork but does not demonstrate the resilience DORA is asking you to prove.

What counts as a DORA resilience test?

Exercising your actual ICT continuity and response plans against a realistic disruption, so you find where they break before an incident does. A facilitated business-continuity exercise against your real plan, such as FAILOVER, is one way to do it.

Who does DORA apply to?

Financial entities in the EU and their critical ICT third-party providers. If you fall under DORA, the operational resilience testing obligation applies to you.

Want to put this in front of your team?

I run these as games your board and your responders actually take part in, not another slideshow. Tell me where your team is and what they need to practice, and we will set it up.

NIS2 turned board-level security training into a legal obligation, not a nice-to-have. Article 20 puts accountability for cyber risk on the management body itself, and Article 20(2) requires those same people to be trained. Most organizations are dealing with that by booking a ninety-minute seminar or an e-learning module. It ticks the box. It does almost nothing for the thing NIS2 actually cares about.

What NIS2 actually asks of your board

Article 20 isn’t a training requirement bolted onto a technical directive. It’s a governance requirement. The management body has to approve the cyber risk-management measures, oversee how they’re implemented, and can be held personally liable when they get it wrong. Article 20(2) then says those same managers have to be trained to identify risks and assess the organization’s cyber risk-management practices. Read that again. The law doesn’t ask your board to be aware of cyber risk. It asks them to make and defend decisions about it.

Why the seminar is the default

The seminar is the obvious answer, and it’s obvious for good reasons. It’s cheap, it scales, one expert can brief a whole leadership team in an afternoon, and it leaves you with an attendance record to show an auditor. If the goal were to inform the board that NIS2 exists and that cyber risk is real, the seminar would be exactly the right tool. That’s just not the goal.

Information is not instinct

A board that has sat through a good NIS2 briefing can tell you what the directive says. That’s not the same as being able to run the meeting where the CISO asks for budget they don’t want to give. Or the meeting thirty minutes after a breach, where someone has to decide what to tell the regulator inside the seventy-two hour window. Those are decisions made under pressure, with half the information you’d like and real consequences either way. You don’t get better at them by being told about them. You get better at them by making them, getting them wrong somewhere it’s safe to get them wrong, and making them again. That’s the training the law has in mind, whether it puts it in those words or not.

What board training looks like when it works

It looks like the board actually making the calls. You put a real governance decision in front of them, with a clock and a trade-off, and let the consequences play out on the table instead of in production. That’s what EXPOSURE does. It’s a board-governance game built around the decisions NIS2 Article 20 puts on management, run as a facilitated half-day. The board doesn’t learn about oversight. They practice it.

NIS2 won’t accept “we ran a seminar” as evidence forever. And even if it did, a seminar was never going to change how your board behaves in the room that actually matters. Train them the way you’d train anyone for a decision that counts. Let them make it.

NIS2 is not the only EU regime raising this bar. DORA does the same for operational resilience in financial services, and the wider case for training over slideware runs through game-based training for EU cyber regulation.

Frequently asked questions

Does NIS2 legally require board-level cybersecurity training?

Yes. NIS2 Article 20(2) requires members of management bodies to undergo training to identify risks and assess cyber risk-management practices, and Article 20(1) makes them accountable for the measures themselves.

Is a seminar or e-learning enough for NIS2 management training?

It satisfies the paper obligation but not the intent. NIS2 holds management accountable for decisions, and a seminar transfers information without ever rehearsing the decisions. It is the minimum, not the goal.

What is the alternative to a NIS2 board seminar?

A facilitated exercise where the board actually makes the governance decisions under pressure, such as a board-governance game like EXPOSURE, so they practice the accountability the law assigns them.

Who is legally accountable under NIS2?

The management body. Article 20 makes them approve and oversee the risk-management measures and allows them to be held liable, which is why their training has to go beyond awareness.

Want to put this in front of your team?

I run these as games your board and your responders actually take part in, not another slideshow. Tell me where your team is and what they need to practice, and we will set it up.