GSA updated its IT security guide outlining how nonfederal systems must protect CUI in accordance with NIST standards.