Congressman Proposes Joint Resolution of Disapproval for CMMC Program Rule
Last Friday, Congressman Gary Palmer introduced legislation to disapprove the Department of Defense's ("DOD") Cybersecurity Maturity Model Certification ("CMMC") Program rule. Styled as House Joint Resolution ("H.J.Res.") 221, the joint resolution, if passed, would nullify the CMMC Program rule published last month.
By way of background, on October 15, 2024, the DOD issued its long-awaited final rule implementing the CMMC Program. The CMMC Program final rule (discussed here) was a culmination of a yearslong effort to shore up cybersecurity in the defense industial base in light of reports that contractors were not adequately implementing existing cyber regulations to protect certain types of unclassified information on contractor information systems. The cited authority for the final rule is Section 1648 of the National Defense Authorization Act for Fiscal Year 2020 (Pub. L. 116-92) , which directed DOD "to develop a consistent, comprehensive framework to enhance cybersecurity for the U.S. Defense Industrial Base."
H.J.Res.221 would undo the CMMC Program by way of the Congressional Review Act ("CRA"), codified at 5 U.S.C. §§ 801-808. As detailed by a Congressional Review Service overview (here), the joint resolution is like any other legislation but it also "must be introduced within a specific time frame: during a 60-days-of-continuous-session period beginning when the rule has been published in the Federal Register and been received by Congress." Under the CRA, if the joint resolution disapproving the rule is enacted, the CMMC Program rule will either go out of effect immediately (if it has already taken effect when the resolution is enacted) or, if it has not yet taken effect, the rule will not take effect.
The CMMC final rule is slated to take effect on December 16, 2024.
Takeaway
The joint resolution is another interesting development for the CMMC Program. Securing the defense industrial base from our Nation's adversaries (and their proxies) has long been a priority for DOD and Congress. At the time of writing, we do not know the specific reasons why the joint resolution was introduced or whether the bill will gain any traction on the Hill.
. . .
Comments