Employers should be aware of recent congressional activity concerning federal workplace heat-safety requirements. The Heat Workforce Standards Act of 2026 (S. 4427) has been introduced in the U.S. Senate, with companion legislation H.R. 6213 advancing in the House. The legislation would prohibit the U.S. Department of Labor from finalizing, implementing, or enforcing OSHA’s proposed heat injury and illness prevention standard, as well as substantially similar future standards. 

The legislation has not become law. Employers should therefore continue to monitor developments, but no new nationwide OSHA heat-specific standard is currently enforceable. 

What Is OSHA’s Current Position? 

Even though there is currently no federal OSHA-specific heat standard, employers still have obligations under OSHA's General Duty Clause of the Occupational Safety and Health Act. OSHA may investigate heat-related conditions as part of an employee complaint, an OSHA inspection, or other enforcement activity. If OSHA determines that employees are exposed to a recognized heat hazard that is causing or likely to cause serious physical harm and that feasible measures exist to address the hazard, the employer may be cited under the General Duty Clause. 

In August 2024, OSHA published a proposed Heat Injury and Illness Prevention in Outdoor and Indoor Work Settings standard. The proposal would generally require employers to establish a written heat injury and illness prevention plan and implement measures addressing heat hazards, including hazard identification, heat controls, acclimatization, employee and supervisor training, and emergency response. The proposal would apply broadly to general industry, construction, maritime, and agricultural workplaces. 

Because the proposal has not been finalized, employers are not currently required to comply with the proposed federal standard solely because it was published. 

State Heat-Safety Requirements Remain in Effect 

Several states have adopted their own workplace heat requirements. Requirements vary considerably by State and may apply to outdoor work, indoor work, or both. 

• California requires heat-illness prevention measures for outdoor workplaces and, since 2024, most indoor workplaces where temperatures reach 82°F. Requirements include water, shade or cool-down areas, rest, training, and written procedures. 

  
  

• Maryland's heat-stress standard, effective September 30, 2024, applies when the heat index reaches 80°F or higher and includes requirements for monitoring, written prevention and management plans, and high-heat procedures. 

  
  

• Minnesota has an indoor heat standard based on work activity and Wet Bulb Globe Temperature (WBGT). Minnesota OSHA confirms that there is currently no Minnesota or federal OSHA standard specifically addressing outdoor heat. 

  
  

• Oregon requires heat-illness prevention measures when the heat index reaches 80°F, including water, shade, rest, acclimatization, training, communication, and emergency planning. Additional requirements apply above 90°F. 

  
  

• Washington's outdoor heat rules generally begin at 80°F and include water, shade or cooling methods, preventative cool-down periods, employee observation, and additional mandatory cool-down periods at 90°F and 100°F. 

  
  

Recommended Employer Action 

Government contractors and other employers with employees working across multiple states should: 

• evaluate heat exposure based on the employee's work location and applicable state requirements 

  
  

• maintain reasonable heat-safety practices appropriate to their operations, particularly for employees performing outdoor, physically demanding, or work in areas without effective climate control 

  
  

• at a minimum consider access to drinking water, appropriate rest or cool-down opportunities, shade or other cooling methods, employee training, acclimatization for employees new to hot conditions, and procedures for responding to signs of heat illness 

C2 Essentials will continue monitoring the federal legislation and developments affecting state heat-safety requirements. Additional guidance will be provided if the federal legislation advances or OSHA's proposed rule changes. 

The U.S. Department of Homeland Security (DHS) is considering a regulatory change that could affect employers with H-1B employees. DHS has submitted a proposed rule that would eliminate the current up to 60-day grace period available to certain nonimmigrant workers after their employment ends. 

The proposal has not yet been published in the Federal Register, and the current 60-day grace period remains in effect. 

Under current rules, eligible H-1B workers may have up to 60 days—or until the end of their authorized stay, if earlier—to pursue another qualifying employment opportunity, change status, or make arrangements to leave the United States. See USCIS: Options for Nonimmigrant Workers Following Termination of Employment. 

The H-1B program allows U.S. employers to temporarily employ foreign workers in “specialty occupations” that generally require specialized knowledge and at least a bachelor's degree or equivalent in a related field. Common H-1B occupations include IT, engineering, accounting, and other professional and technical roles.

The sponsoring employer generally must file a Labor Condition Application (LCA) with the U.S. Department of Labor and an H-1B petition with U.S. Citizenship and Immigration Services (USCIS), in addition to meeting applicable wage and other H-1B requirements. H-1B status is generally granted for an initial period of up to three years and can typically be extended for another three years. 

Why It Matters to Employers 

The current grace period gives an eligible H-1B employee time to find another employer willing to sponsor the employee and complete the required immigration process. The prospective employer generally must file a new H-1B petition and may incur government filing fees and legal costs as part of the process. 

Without the grace period, an employee whose H-1B employment ends could have significantly less time to find another sponsoring employer and address their immigration status while remaining in the United States. Depending on the circumstances, the employee could have fewer options to transition to another employer without leaving the country. 

This could be particularly significant for government contractors that employ H-1B professionals in specialized positions. 

• A tighter window to hire qualified H-1B talent — Contractors may have less time to identify and secure an H-1B candidate before the candidate's immigration status becomes an issue. 

  
  

• A smaller available talent pool — A qualified H-1B candidate who recently lost employment may have less flexibility to pursue a new position if the grace period is eliminated. 

  
  

• Greater risk to contract staffing requirements — Government contracts may require specific positions to be filled within defined timeframes. Losing a specialized employee or being unable to onboard a qualified replacement quickly could create operational challenges. 

  
  

• More pressure on recruiting and HR — Contractors may need to move quickly on qualified H-1B candidates while coordinating immigration filings, onboarding, and contract-specific requirements. 

  
  

• Additional costs and planning considerations — A new employer may incur immigration filing fees and legal expenses when sponsoring an H-1B worker. 

For government contractors, the impact may be greater when positions are subject to U.S. citizenship, security-clearance, or other contract-specific eligibility requirements. An H-1B employee cannot move into a position that legitimately requires U.S. citizenship based solely on their H-1B work authorization. If the employee's current position ends, the pool of positions available to that employee may therefore be more limited. 

Citizenship Requirements 

Government contractors should not assume that all positions may be limited to U.S. citizens. A citizenship requirement must generally be supported by a specific law, regulation, executive order, or government contract requirement. For example, a federal contract may require certain positions to be filled by U.S. citizens, and certain security-clearance requirements may impose citizenship restrictions.

Employers should identify the specific legal or contractual basis for the requirement rather than assume that every position involving a security clearance is automatically limited to U.S. citizens. Where a position is legitimately restricted to U.S. citizens, an H-1B employee would not be eligible for that position based solely on their H-1B work authorization. 

What Employers Should Do 

No immediate action is required. Employers should continue following current H-1B requirements but may want to: 

• Identify H-1B employees in critical or difficult-to-fill positions. 

  
  

• Consider immigration implications when planning terminations or workforce reductions. 

  
  

• Consult immigration counsel before terminating an H-1B employee. 

  
  

• Monitor the proposed rule and any changes to the current grace-period requirements. 

  
  

The 60-day grace period remains in effect today. However, employers that rely on H-1B talent should be aware of the proposed change and consider its potential impact on staffing and contract continuity. 

Employers should be aware of new pay transparency requirements taking effect during the second half of 2026. As more states adopt pay disclosure laws, organizations recruiting across state lines should review their hiring practices to ensure job advertisements comply with each state's requirements. 

Connecticut – Effective October 1, 2026 

Connecticut is expanding its existing pay transparency law. Beginning October 1, employers must include the wage or wage range and a general description of benefits in both public and internal job postings. The requirement applies to positions located in Connecticut as well as certain remote positions that report to a Connecticut office, supervisor, or worksite. 

What Employers Should Do 

Multi-state employers should review hiring procedures now to ensure job postings meet the requirements of the states in which they recruit or employ workers. Consider: 

• Reviewing job posting templates to include required pay information where applicable. 

  
  

• Confirming pay ranges are established in good faith and align with compensation practices. 

  
  

• Evaluating whether remote positions may be subject to another state's disclosure requirements. 

  
  

• Coordinating with any third-party recruiting firms or job posting vendors to ensure compliant advertisements. 

  
  

• Maintaining records where required by state law. 

  
  

As additional states continue to adopt pay transparency laws, employers should expect ongoing changes to recruiting and hiring compliance obligations. Organizations hiring across multiple jurisdictions should regularly monitor new state requirements and update their job posting practices accordingly. 

As your trusted HR compliance consultant, C2 helps multi-state employers navigate evolving federal and state employment laws, reduce compliance risk, and implement practical HR best practices. If you have questions about these new pay transparency requirements or need assistance reviewing your hiring practices, please contact C2 Essentials. 

Virginia's new Paid Family and Medical Leave (PFML) program creates a state-administered paid leave insurance program that provides eligible employees with partial wage replacement when they need time away from work for qualifying family or medical reasons, such as the birth or adoption of a child, caring for a family member with a serious health condition, the employee's own serious health condition, or certain military-related events.

The program will be funded through payroll contributions beginning April 1, 2028, with benefits expected to become available December 1, 2028 (or early 2029, depending on state implementation). 

Separate from PFML, Virginia also enacted a Paid Sick Leave requirement that phases in beginning July 1, 2027, requiring covered employers to provide employees with paid sick leave for routine illness, preventive care, and certain family care needs. 

The new laws establish minimum statutory leave benefits and generally do not require employers to eliminate or replace existing Paid Time Off (PTO), vacation, or sick leave policies. Employers may continue offering more generous benefits than required by state law. 

Final regulations from the Virginia Employment Commission are expected to provide additional guidance on leave coordination before the programs become effective. 

How PFML Differs from Paid Sick Leave 

For employers with Virginia employees, it is important to distinguish between the two new laws: 

1. Paid Family & Medical Leave (PFML) – a state-run insurance program funded through payroll contributions.  

   
   

• Employees may qualify for up to 12 weeks of wage replacement benefits from the state PFML insurance program.  

  
  

• Eligible employees may receive 80% of their average weekly wage  

  
  

• Employers will be responsible for payroll contributions and employee withholdings, as applicable once the state establishes contribution rates.  

  
  

• PFML is intended for longer-term qualifying family and medical leave events and operates separately from employer PTO or sick leave policies, although employers will need to coordinate these benefits with their existing leave programs.  

  
  

• Employees will apply directly to the Virginia Employment Commission (VEC) for benefits, not to their employer. The VEC will determine eligibility, approve claims, and pay benefits.  

  
  

• Employers will verify employment and wages and provide required information to the VEC.  

  
  

2. Paid Sick Leave (PSL) – an employer-provided leave benefit with minimum accrual requirements.

The U.S. Equal Employment Opportunity Commission (EEOC) has taken the first step toward eliminating the long-standing requirement for many employers to file annual workforce demographic reports, including the EEO-1 report. While this represents a significant potential change, it is only a proposed rule and is not currently in effect. 

Although this proposal has received considerable attention, no employer reporting requirements have changed at this time. The proposal must complete the federal rulemaking process, including a public comment period and issuance of a final rule, before any changes become effective.

Until then, employers should continue to comply with all current EEO-1 reporting and recordkeeping requirements, as well as any other applicable federal contractor and state reporting obligations. 

As part of our normal compliance support process, C2 Essentials prepares draft EEO-1 reports using available payroll and workforce data and provides to applicable clients for review and confirmation prior to submission.

At this time, the EEOC has not opened the 2026 EEO-1 reporting period. If the EEOC reporting cycle proceeds under the current requirements, C2 Essentials will assist with preparation of the applicable reports and will communicate next steps to impacted clients. 

What Employers Should Know 

The EEO-1 Report is an annual workforce demographic report that summarizes the number of employees by job category, race/ethnicity, and sex. The report contains aggregated workforce data rather than individual employee information and has historically been used by the EEOC to support enforcement of federal equal employment opportunity laws. 

Private-sector employers that have 100 or more employees during the selected workforce snapshot period are generally required to file an EEO-1 report. Federal contractors and first-tier subcontractors generally must file an EEO-1 report if they have 50 or more employees, and hold at least one qualifying federal contract, subcontract, or purchase order meeting the applicable monetary threshold (currently $50,000 or more). 

If finalized, the proposal would remove the federal requirement for covered employers to annually report workforce demographic information by race and sex. According to the EEOC, the proposed change is intended to reduce the administrative burden associated with annual demographic reporting and reflects the agency's current enforcement priorities.  

No Immediate Changes to Employer Equal Employment Obligations 

While the EEOC's proposal could ultimately reduce one federal reporting requirement, it should not be interpreted as a broader reduction in equal employment opportunity or federal contractor compliance obligations. 

Employers must continue to make employment decisions without regard to protected characteristics and comply with all applicable anti-discrimination laws. Employers should continue following existing federal equal employment opportunity laws, including:  

• Title VII of the Civil Rights Act - prohibits employment discrimination based on race, color, religion, sex, and national origin. Federal contractors and other covered employers must continue maintaining nondiscriminatory employment practices and complying with applicable equal employment opportunity requirements, regardless of any future changes to EEO reporting obligations. 

For federal government contractors, this proposal does not eliminate other federal compliance obligations that may still apply. Employers should continue to comply with all existing contractual and statutory requirements, including: 

• VETS-4212 reporting: Federal contractors and subcontractors with a federal contract or subcontract of $150,000 or more (based on the Vietnam Era Veterans' Readjustment Assistance Act (VEVRAA) threshold) must continue submitting annual VETS-4212 reports, which provide information regarding the employment of protected veterans within their workforce by September 30 each year.  As part of our normal compliance support process, C2 Essentials prepares draft VETS-4212 reports using available payroll and workforce data and provides them to applicable clients for review and confirmation prior to submission 

  
  

• Federal and state recordkeeping requirements related to employment decisions - Employers must continue maintaining appropriate employment records, including documentation related to hiring, promotions, compensation decisions, terminations, accommodations, and other employment actions, in accordance with applicable federal and state requirements. These records remain important for demonstrating compliance with equal employment opportunity obligations.  

  
  

Official Resources 

• EEOC News Release

  
  

• EEOC Notice of Proposed Rulemaking (NPRM)

The U.S. Department of Veterans Affairs (VA) has announced a significant multi-year technology modernization initiative intended to improve how veterans receive healthcare services and benefits. The effort focuses on replacing or integrating aging systems with modern cloud-based platforms, artificial intelligence (AI), enhanced collaboration tools, and improved data management. An initial award has been made to Salesforce (CRM) worth up to $1.6B to modernize veteran’s care.  

The modernization initiative is expected to support several operational improvements, including: 

• Streamlining administrative processes and reducing manual workloads for VA personnel. 

  
  

• Enhancing communication and coordination across VA offices and healthcare providers. 

  
  

• Improving access to information through better integration of existing data systems. 

  
  

• Expanding AI-assisted tools to help manage routine inquiries, care coordination, and benefits-related processes. 

The Department of Veterans Affairs operates the nation's largest integrated healthcare system, serving millions of enrolled veterans through more than 1,300 healthcare facilities with: 

• Approximately 17.6 million living U.S. veterans nationwide (FY 2025 estimate).  

  
  

• Approximately 9.1 million veterans enrolled in VA health care.  

  
  

• Approximately 6.3 million unique veteran patients receiving VA healthcare annually.  

  
  

Why This Matters for Government Contractors 

For contractors supporting the VA, this investment represents more than a technology upgrade. It signals the agency's continued commitment to digital transformation and may create additional opportunities for organizations providing: 

• Information technology modernization and cloud services. 

  
  

• Systems integration and data migration. 

  
  

• Cybersecurity and FedRAMP-compliant solutions. 

  
  

• Artificial intelligence and automation technologies. 

  
  

• Data analytics and business intelligence. 

  
  

• Training, change management, and end-user support. 

Small businesses and subcontractors should also monitor upcoming procurement opportunities, as large modernization programs frequently generate subcontracting needs across multiple technical disciplines. 

Understanding the Current Environment 

The VA continues to operate a combination of legacy information systems developed over many years. As with many large federal agencies, maintaining multiple platforms can create challenges related to data sharing, workflow efficiency, and user experience.

Modernization initiatives seek to improve interoperability, reduce administrative complexity, and provide employees with quicker access to the information needed to serve veterans. 

Government contractors that currently support—or are interested in supporting—the Department of Veterans Affairs should continue monitoring VA procurement announcements and teaming opportunities.

Organizations with expertise in cloud technologies, cybersecurity, AI, systems integration, data management, and workforce training may find new opportunities as the VA advances its modernization strategy. 

While the modernization effort is focused on improving services for veterans, it also reflects broader federal priorities to modernize legacy IT infrastructure, strengthen cybersecurity, improve data sharing, and responsibly deploy artificial intelligence.

These priorities continue to drive acquisition strategies across civilian and defense agencies, creating opportunities for contractors that provide cloud services, cybersecurity, systems integration, data management, AI-enabled solutions, training, and change management support. 

Additional Resources 

• U.S. Department of Veterans Affairs Newsroom – Official announcements on VA modernization initiatives, technology updates, and agency news.  

  
  

• VA Electronic Health Record Modernization Updates – Information on the VA's ongoing efforts to modernize its electronic health record systems and improve interoperability across veteran healthcare. This initiative has been a key component of the VA's broader digital transformation efforts.  

  
  

• SAM.gov Contract Opportunities – Federal procurement opportunities, including VA solicitations and subcontracting opportunities.  

  
  

• U.S. Department of Veterans Affairs Office of Small & Disadvantaged Business Utilization (OSDBU) – Resources for small businesses seeking to compete for VA contracts, including Veteran-Owned Small Businesses (VOSBs) and Service-Disabled Veteran-Owned Small Businesses (SDVOSBs). 

The Defense Counterintelligence and Security Agency (DCSA) Trusted Workforce 2.0 Rap Back expansion is being implemented through a phased approach. DCSA has confirmed that Phase 3 involves personnel who do not already have fingerprints available for enrollment, with additional operational guidance to follow. 

The Defense Counterintelligence and Security Agency (DCSA) is continuing implementation of Trusted Workforce 2.0 (TW 2.0) and the FBI Record of Arrest and Prosecution Back (Rap Back) program.  

The next phase of Trusted Workforce 2.0 Rap Back enrollment will require fingerprint collection for certain cleared personnel who do not have eligible fingerprints already on file. 

Rap Back supports continuous vetting by allowing authorized government agencies to receive notifications of certain criminal history record changes through fingerprint-based enrollment.  

As part of this phased implementation, DCSA is preparing for fingerprint collection for cleared personnel who do not already have eligible fingerprints available for Rap Back enrollment. Additional operational guidance, including collection procedures and applicable voucher information, is expected from DCSA as implementation progresses.  

Contractors should begin preparing now to avoid delays once fingerprint collection instructions and voucher codes become available. As part of the broader Rap Back transition, FSOs should also ensure required FBI advisements have been distributed to applicable cleared personnel and that documentation of distribution is maintained. 

Important: Each contractor’s Facility Security Officer (FSO) remains responsible for managing DCSA security requirements, coordinating employee actions, and maintaining required security documentation. C2 Essentials is providing this information as a compliance awareness resource. 

Current Status: Affected Personnel Identification 

DCSA is providing lists of potentially affected personnel ("Subjects") directly to Industry Security Management Offices (SMOs). 

Due to data volume and privacy considerations: 

• SMOs with fewer than 75 Subjects: Lists may include full names of affected individuals.  

  
  

• SMOs with 75 or more Subjects: Identifying information provided may be limited.  

If your organization identifies employees with common names and cannot confidently match an individual, please complete internal verification efforts first. If additional assistance is needed, organizations may contact the DCSA Industry Agency Liaison

Funding Timeline: Voucher Availability and Expiration 

DCSA is expected to provide fingerprint voucher codes intended to offset vendor costs associated with eligible Rap Back enrollments. 

Key considerations: 

• Voucher expiration: September 30, 2026  

  
  

• After expiration: Contractors may be responsible for vendor fingerprinting costs associated with required Rap Back enrollments.  

  
  

• Usage limitations: Voucher codes are intended only for Rap Back enrollment fingerprint processing and cannot be applied to unrelated background check activities.  

  
  

Recommended Contractor Actions 

1. Coordinate with Your FSO 

Ensure your Facility Security Officer or Security Management Office is monitoring official DCSA communications and preparing for upcoming requirements. 

2. Review Your Cleared Personnel Roster 

Once DCSA provides affected personnel information, verify identified individuals against your active cleared employee roster. 

3. Prepare Affected Personnel 

Inform impacted cleared employees that fingerprint collection may be required and that prompt scheduling may be necessary once DCSA procedures and voucher information become available. 

4. Maintain Documentation 

Continue maintaining required security documentation related to TW 2.0 implementation, including applicable FBI advisement distribution records.  

C2 Essentials will continue monitoring DCSA guidance and will provide additional updates as official implementation procedures become available. 

Maryland's Family and Medical Leave Insurance (FAMLI) program is moving into its implementation phase. Employers with employees working in Maryland should begin preparing now for registration, payroll deductions, and employee communications. 

FAMLI creates a state-administered paid family and medical leave benefit that provides eligible employees with partial wage replacement for qualifying family and medical leave. The program supplements—not replaces—your existing PTO, vacation, sick leave, or other employer-provided leave benefits. Employers should review their leave policies to ensure they coordinate appropriately with FAMLI and, where applicable, the federal Family and Medical Leave Act (FMLA).  

Client Action Items 

• Register your business in the Maryland FAMLI portal when registration opens in September 2026.  

  
  

• Authorize C2 Essentials as your Third-Party Administrator during the registration process.  

  
  

• No separate insurance purchase is needed if electing to participate in the Maryland State Plan. Consult with your benefits broker if you are considering a private plan*.   

  
  

How C2 Essentials Will Help 

As your HR and payroll compliance partner, C2 Essentials will: 

• Register as your authorized Third-Party Administrator (TPA).  

  
  

• Calculate and remit required FAMLI contributions.  

  
  

• Submit required quarterly wage reports.  

  
  

• Provide employee notices through C2Connection when released by the State.  

  
  

• Update client handbooks with Maryland FAMLI policy language.  

  
  

• Provide ongoing compliance guidance as additional regulations are issued.  

  
  

Key Employer Timeline 

Employer Contributions 

The initial State Plan contribution rate is 0.90% of covered wages beginning January 1, 2027. 

• Employers with fewer than 15 employees (counting employees inside and outside Maryland): 

  
  

• No mandatory employer contribution; employee payroll deductions may still apply.  

  
  

• Employers with 15 or more employees (counting employees inside and outside Maryland): 

  
  

• The total contribution is 0.90% of covered wages, with up to 0.45% deducted from employees and the remaining amount paid by the employer (unless the employer elects to pay a greater share).  

  
  

State Plan vs. Private Plan 

Employers should evaluate which option best meets their organization's needs before payroll deductions begin. 

Opting for the State Plan 

• No insurance policy is required.  

  
  

• Contributions are remitted directly to Maryland.  

  
  

• Employee claims are administered by the State.  

  
  

Opting for a Private Plan 

• Purchased through an insurance carrier or benefits broker.  

  
  

• Premiums will depend on factors such as: 

  
  

  • employer size  

    
    

  • payroll  

    
    

  • workforce demographics  

    
    

  • industry  

    
    

  • leave history  

    
    

  • plan design  

    
    

  • whether the employer already provides paid parental leave or short-term disability benefits  

    
    

• Must provide benefits that are at least equivalent to the State Plan.  

  
  

• May offer greater administrative flexibility for employers that already provide paid leave or short-term disability benefits.  

  
  

• Compare premiums and benefits and select a plan that provides benefits equal to or greater than Maryland's requirements.  

  
  

• Submit a Declaration of Intent and later a private plan application to Maryland within the required filing window.  

  
  

• Once approved, employees receive benefits through the private carrier rather than the State Plan.  

While TikTok has resumed broad availability to U.S. consumers, government contractors should remember that many federal agencies continue to prohibit the application on government-issued devices and may impose additional contractual cybersecurity requirements. The platform's availability to the general public does not alter existing federal security obligations. 

TikTok's availability in the United States highlights the importance of maintaining strong cybersecurity practices rather than focusing solely on the status of a single application. As a reminder the app has been banned since 2022: 

• 2022: Congress passed legislation prohibiting TikTok on federal government devices, citing cybersecurity and national security concerns. 

  
  

• 2023–2025: Additional legislation, court challenges, and executive actions addressed TikTok's ownership and continued operation in the United States. 

  
  

• Early 2026: TikTok's availability in the U.S. remained uncertain as legal and regulatory actions continued. 

Government contractors should remember that many federal agencies and contracts impose security requirements that may restrict the use of certain applications on government-issued devices or on devices used to access government systems and information. Employees should not assume that an application available to the general public is permitted in every government contracting environment. 

Now is a good time for contractors to review their acceptable use, mobile device, and Bring Your Own Device (BYOD) policies to ensure they remain aligned with customer requirements and current cybersecurity expectations. Organizations supporting federal agencies should remind employees to follow all agency-specific security policies, safeguard Controlled Unclassified Information (CUI) where applicable and report any questions regarding authorized software or mobile device use before installing applications that could present security or contractual compliance risks.