Congress moves to kill Pentagon's defense contractor cybersecurity mandate
H.J.Res. 40 — Providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Department of Defense relating to "Cybersecurity Maturity Model Certification (CMMC) Program". · Filed by Andrew Clyde (R-GA) · Introduced Feb 12, 2025 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This resolution disapproves a Department of Defense rule establishing the Cybersecurity Maturity Model Certification (CMMC) Program, which requires defense contractors to meet specific cybersecurity standards. If passed, the rule would be nullified and have no legal effect, eliminating the certification requirement for contractors seeking to work with the Pentagon.
Why we flagged it
The resolution removes a cybersecurity compliance mandate from defense contractors, reducing regulatory burden on private firms in the defense industrial base at the expense of national security standards.
What the text implies
- Elimination of CMMC removes a tiered certification system designed to protect classified and controlled unclassified information (CUI) flowing through the defense supply chain; contractors will have no standardized security baseline.
- Small and mid-sized defense contractors may have already invested in CMMC compliance; disapproval could strand those compliance costs while benefiting non-compliant competitors.
- Foreign adversaries conducting supply-chain espionage may find easier access to defense intellectual property and military specifications if contractor cybersecurity standards are eliminated.
- The rule was published in October 2024 after years of DoD development; disapproval reverses a multi-year regulatory process without stated alternative security framework.
Section numbers refer to the bill text the analysis read — linked under Primary records below.
Who it affects
Eliminating mandatory cybersecurity standards for defense contractors increases the risk of successful cyberattacks on military systems and sensitive defense infrastructure, potentially compromising national security and exposing classified information. Citizens bear the security cost of a weaker defense supply chain.
Who stands to gain
- defense contractors (reduced compliance costs)
- smaller defense suppliers (lower barriers to Pentagon contracts)
Named in the bill
Department of Defense, Cybersecurity Maturity Model Certification (CMMC) Program, defense contractors, Federal Register (89 Fed. Reg. 83092), House Committee on Armed Services, Rep. Andrew Clyde (sponsor)
Where it stands
- Feb 12, 2025 — Introduced · Congress.gov: “Introduced in House”
- Feb 12, 2025 — Referred to House Committee on Armed Services · Congress.gov: “Referred to the House Committee on Armed Services”
Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.
How this was measured
Analysis — Quorum's AI read the bill text published by Congress.gov (1,074 characters) on May 21, 2026. Section numbers in the findings refer to that text, linked below; transparency and hidden-provision scores are compared against the median of 16,222 analysed bills.
Status and sponsors — Congress.gov's bill record — actions, committee referrals and cosponsors — loaded nightly. The timeline shows status changes, not every procedural action.
As of — page rendered 2026-10-20.
“Congress moves to kill Pentagon's defense contractor cybersecurity mandate” QuorumCivic. https://share.quorumcivic.app/bill/119/hjres40 Report an error
The week in bills
One email, Sunday: what Congress passed, what it changed, and who paid.
One link arrives to confirm the address. It is used for this email and nothing else, and every issue carries an unsubscribe link.