H.J.Res. 40 explained · 119th Congress · Pending in Congress
Providing for congressional disapproval under chapter 8 of title 5, United States Code, of the rule submitted by the Department of Defense relating to "Cybersecurity Maturity Model Certification (CMMC) Program".
Cosponsors: none · per Congress.gov, 2026-10-12
Introduced: 2025-02-12
Latest action (2025-02-12): Referred to the House Committee on Armed Services.
What H.J.Res. 40 does, in plain terms
This joint resolution nullifies the Department of Defense (DOD) rule titled Cybersecurity Maturity Model Certification (CMMC) Program (89 Fed. Reg. 83092) and published on October 15, 2024. Among other elements, the rule establishes the Cybersecurity Maturity Model Certification Program. The program institutes policies regarding the protection of Federal Contract Information (FCI) and Controlled Unclassified Information (CUI) that is processed, stored, or transmitted on defense contractor and subcontractor information systems during defense contract performance. The rule also identifies entities to which the rule applies and describes DOD implementation of the program.
Official summary by the Congressional Research Service, via Congress.gov.
Constitution Index
“VFA Constitution grade”
Not graded yet
H.J.Res. 40 has not been graded yet. New measures with an official summary are graded daily under the published rubric.
What should pass
“VFA SI Solution”
No solution yet
A sourced SI draft appears here once it passes automated checks (Constitution citation, source verification, independent SI critic). How publication works.
For journalists and bloggers
“Embed this grade”
Free to use with the link back. The badge and card update when the grade changes. Embed terms →
