Timing for second CMMC rulemaking could face hurdles amid Trump directives on deregulation

The Defense Department’s plan to finalize the second rulemaking for the Cybersecurity Maturity Model Certification program by mid-2025 is starting to slip as the Pentagon works to meet requirements from President Trump’s Jan. 31 executive order on deregulation.

The EO directs any “executive department or agency” proposing a new regulation to identify “at least 10 prior regulations” for elimination. There are exemptions for national security and several rulemakings from other agencies have been submitted to OMB’s Office of Information...