Us Congress 2025-2026 Regular Session

Us Congress House Bill HJR40

Introduced
2/12/25  

Caption

This joint resolution nullifies the Department of Defense (DOD) rule titled Cybersecurity Maturity Model Certification (CMMC) Program (89 Fed. Reg. 83092) and published on October 15, 2024. Among other elements, the rule establishes the Cybersecurity Maturity Model Certification Program. The program institutes policies regarding the protection of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) that is processed, stored, or transmitted on defense contractor and subcontractor information systems during defense contract performance. The rule also identifies entities to which the rule applies and describes DOD implementation of the program.

Impact

The passage of HJR40 would prevent the enforcement of the CMMC rule, which may have wide-ranging implications for defense contractors and businesses in the cybersecurity space. Without the CMMC certification requirements, experts suggest that the protection of sensitive defense-related information could be compromised, resulting in increased vulnerability to cyberattacks. The immediate effect on businesses would be the elimination of the compliance burden that CMMC would impose, but in the long term, this might weaken overall cybersecurity governance within the defense sector.

Summary

HJR40 is a joint resolution that seeks to disapprove a rule set forth by the Department of Defense regarding the Cybersecurity Maturity Model Certification (CMMC) Program. This resolution is an expression of Congress's authority to overturn regulations that it deems unnecessary or overreaching. The CMMC program involves a framework intended to enhance cybersecurity standards within the defense industrial base, aimed at protecting sensitive information from cyber threats. However, this resolution will potentially halt its implementation, indicating serious concerns amongst some legislators about the requirements proposed under this program.

Contention

Debate surrounding HJR40 has called attention to the balance between necessary government regulations and undue restrictions on businesses. Proponents of the resolution argue that the CMMC outlines an overly complex and potentially costly set of obligations that may hinder smaller companies’ ability to compete for defense contracts. In contrast, opponents counter that rejecting the CMMC undermines essential measures needed to safeguard national security interests. This legislative maneuver reflects differing views on the role of regulatory oversight in ensuring cybersecurity readiness in critical sectors.

Congress_id

119-HJRES-40

Policy_area

Armed Forces and National Security

Introduced_date

2025-02-12

Companion Bills

No companion bills found.

Previously Filed As

US HJR221

Providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Department of Defense relating to "Cybersecurity Maturity Model Certification (CMMC) Program".

US SB2251

Rural Hospital Cybersecurity Enhancement Act Federal Information Security Modernization Act of 2023

US HB78

Let Lenders Lend Act This bill nullifies the final rule issued by the Consumer Financial Protection Bureau titled Home Mortgage Disclosure (Regulation C) and published on October 28, 2015. (The rule expands the scope of information that financial institutions must disclose regarding home mortgages.)

US SB5028

Federal Contractor Cybersecurity Vulnerability Reduction Act of 2024

US HB262

All Economic Regulations are Transparent Act of 2023 or the ALERT Act of 2023 This bill establishes various reporting requirements with respect to federal agency rulemaking. Specifically, each agency must submit a monthly report to the Office of Information and Regulatory Affairs (OIRA) for each rule the agency expects to propose or finalize during the following year, including information about the objectives and legal basis for the rule as well as whether the rule is subject to periodic review based on its significant economic impact. Additionally, each agency must submit a monthly report for any rule expected to be finalized during the following year for which the agency has issued a general notice of proposed rulemaking, including an approximate schedule for completing action on the rule and an estimate of its cost and economic effects. OIRA must publish this information online and, subject to certain exceptions, a rule may not take effect until the information has been published for at least six months. The bill also requires OIRA to annually publish in the Federal Register specified information it receives from agencies under this bill, including a list of each rule an agency has proposed and the total cost of all rules proposed or finalized. OIRA must further publish online (1) any analysis of the costs or benefits of rules that were proposed or finalized during the previous year, and (2) a list of rules that were subjected to various forms of review during the previous year.

US HB276

DHS Cybersecurity On-the-Job Training and Employment Apprentice Program Act This bill requires the Department of Homeland Security (DHS) to establish a DHS Cybersecurity On-the-Job Training and Employment Apprentice Program to identify and train DHS employees for cybersecurity work. The Cybersecurity and Infrastructure Security Agency within DHS must lead the program. Among other things, the agency must (1) track the status of cybersecurity positions at DHS, (2) develop a program curriculum, and (3) recruit DHS employees for the program.

US SJR27

A joint resolution providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Office of Federal Contract Compliance Programs of the Department of Labor relating to "Rescission of Implementing Legal Requirements Regarding the Equal Opportunity Clause's Religious Exemption Rule".

US SJR36

A joint resolution providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Office of Federal Contract Compliance Programs of the Department of Labor relating to "Rescission of Implementing Legal Requirements Regarding the Equal Opportunity Clause's Religious Exemption Rule".

US HB9290

To direct the Chief Information Officer of the Department of Defense and the Director of the Defense Information Systems Agency to jointly provide to the Committees on Armed Services of the Senate and House of Representatives a briefing on the plan of the Department of Defense to transition away from the Joint Regional Security Stacks, and for other purposes.

US HB9295

To direct the Chief Information Officer of the Department of Defense to provide a briefing to Congress on security options for the Joint Warfighter Cloud Capability program, and for other purposes.

Similar Bills

No similar bills found.