Cybersecurity Policy Report, Cyber Rules for Defense Contractors Targeted by House CRA Resolution, (Feb 14, 2025)
Cybersecurity requirements for contractors issued last year by the Department of Defense would be rescinded under a House resolution filed by Rep. Andrew Clyde (R., Ga.).
Rep. Clyde introduced the Congressional Review Act (CRA) resolution (H.J.Res. 40, 119th Cong. (2025)) to invalidate DoD’s final rule to implement the Cybersecurity Maturity Model Certification (CMMC) program (CPR, Oct. 11, 2024).
The CMMC framework became effective last December. DoD intends to gradually add CMMC requirements to its contracts over three years. The requirements will vary depending on how much sensitive information a contractor is expected to handle.
Rep. Clyde filed 13 CRA resolutions this week targeting a variety of agency rules enacted during the Biden administration pursuant to CRA’s “lookback period,” which gives Congress “an additional review period to introduce joint resolutions of disapproval for rules submitted within the last few months of a President’s outgoing term,” he said in a news release.
News: DataSecurity FederalLegislation