Rep. Gary Palmer (R-AL) has introduced a Congressional Review Act resolution that would roll back a final rulemaking to establish the Pentagon's Cybersecurity Maturity Model Certification program, as part of an effort by the GOP lawmaker to put Congress in a position to weigh in on major regulatory initiatives.
The resolution, introduced on Nov. 15, addresses a DOD final rule published Oct. 15 in the Federal Register. Under the CRA, DOD must provide 60 days for the rulemaking to go into effect to give lawmakers the opportunity to review it.
The Government Accountability Office sent an assessment on Oct. 30 to House and Senate Armed Services leaders which concluded that DOD had completed the necessary “procedural steps” to put the final rulemaking into place.
The CMMC final rule amends Title 32 of the Code of Federal Regulations to establish the program. A second rulemaking to amend the Defense Federal Acquisition Regulation Supplement recently went through a public comment period as a notice of proposed rulemaking and is in the adjudication stage at DOD.
Palmer’s resolution has raised concerns among stakeholders who have invested in growing the CMMC ecosystem including the Managed Service Provider Collective, which is advocating on Capitol Hill for continued investments in the CMMC program.
The MSP Collective argues that the use of an MSP can help companies reach compliance with CMMC quicker and more cost effectively than trying to meet all of the CMMC requirements on their own. The collective is also working to encourage lawmakers to create tax incentives that will help small businesses reach compliance.
Finalizing the first CMMC rule was a major accomplishment for DOD and signaled to industry three years after the program went through an internal review that CMMC will start showing up in DOD contracts next year.
Defense primes have indicated since the rulemaking was published that a CMMC certification will be included in the competitive selection process for subcontractors when primes are bidding on major contracts with CMMC requirements.
A spokesperson for Palmer told Inside Cybersecurity that Palmer is “not stating a policy stance” on the CMMC rulemaking and “just making sure Congress votes on it.” Palmer has introduced over 30 CRAs that address various rulemakings and plans to introduce more this year, according to the spokesperson.
Palmer is “looking at the large impact ones, rules that are impacting the American people,” the Palmer staffer said, “instead of agencies passing [major rules] without Congress voting.”
As the lone representative on the CMMC resolution, it is unlikely to get much support from other lawmakers before the end of the current legislative session.
At a 2023 hearing, Senate Armed Services cyber subcommittee Chairman Joe Manchin (I-WV) called the CMMC program and the National Security Agency’s Cybersecurity Collaboration Center “crucial guidelines and resources for our private industry partners.”
MSP Collective director Stuart Itkin emphasized to Inside Cybersecurity that his group doesn’t want Palmer’s resolution to be seen as a reason for “companies in the defense industrial base to believe the program is in jeopardy and relax their requirements to satisfy other obligations” under CMMC.
The NIST 800-171 standard has been a requirement for DOD contractors who hold controlled unclassified information since 2017. CMMC adds in a third-party assessment and DOD has strongly encouraged companies to make investments now before the rulemaking process is complete to ensure that they can compete for contracts.
