A final rule terminating the general waiver of Buy America requirements for manufactured products is under final review. On October 7, 2024, the Federal Highway Administration (FHWA) under the Department of Transportation sent the rule “Application of Buy America to Manufactured Products” to the White House Office of Management and Budget’s Office of Information and Regulatory Affairs (OIRA), the last step before being officially published.
Under a proposed rule released in March 2024, the FHWA revoked the waiver, which has been operational since 1983, permitting manufactured products used in highway projects, excluding those predominantly made of iron or steel, to be sourced from outside the United States. The proposal also updated the FHWA’s standards for manufactured products under the Buy America requirements.
Under the rulemaking the FHWA intends to terminate the general waiver of Buy America requirements and revise the standards to align with the “Build America, Buy America” Act (BABA) enacted in 2021. The BABA mandates that all federally assisted infrastructure projects utilize domestically produced iron, steel, manufactured products, and construction materials.
In addition to discontinuing the waiver, the FHWA proposes updating standards to define a manufactured product, aligning them with BABA’s definition, which stipulates that “a manufactured product must be produced in the United States and that the cost of components mined, produced, or manufactured in the United States must exceed 55 percent of the total cost of all components of the manufactured product.” The final rule is expected to be released in December 2024.
EPA Releases List of Chemicals for Future Prioritization under TSCA
The Environmental Protection Agency (EPA) has released the list of candidate chemical substances currently under consideration for future prioritization. Prioritization is the initial step in the process of evaluating existing chemicals under the Toxic Substances Control Act (TSCA) and implementing regulations. Under the process of evaluating, the EPA will determine if each of the candidate chemical substances are a high- or low-priority for risk evaluation. The designation of “High Priority Substances” triggers mandatory evaluations and rulemaking. The 27 chemical substances flagged in the pre-prioritization process include benzene, cobalt & cobalt compounds, antimony & antimony compounds, lead & lead compounds, long-chain chlorinated paraffins, and medium-chain chlorinated paraffins. The EPA is currently accepting comments through October 31, 2024, including data and scientific research, regarding the candidate chemicals to help determine which of the chemical substances should undergo prioritization in the near term.
EPA Response to Courts on “Good Neighbor” Rule Under Review
An action responding to comments by the courts on the validity of the expansion of “good neighbor” requirements of the Clean Air Act, which was stayed by the Supreme Court (SCOTUS) in June 2024, has been submitted by the Environmental Protection Agency (EPA) to the White House for review. The White House Office of Management and Budget’s Office of Information and Regulatory Affairs (OIRA) received the “Voluntary Partial Remand of the Good Neighbor Plan to Respond to Comments” on October 10, 2024.
While the Good Neighbor Plan (GNP) rule was already on hold in Alabama, Arkansas, Kentucky, Louisiana, Minnesota, Mississippi, Missouri, Nevada, Oklahoma, Texas, Utah, and West Virginia; the D.C. Circuit Court has before it a challenge from Ohio, Indiana, and West Virginia arguing that the rule was devised relying on the assumption of 23 states participating, and with the rule on hold in 12 states, it placed a significant burden on the remaining 11 states. After the D.C. Circuit denied a motion to halt enforcement of the rule, the states asked SCOTUS to do so. The decision by SCOTUS blocked the rule in the remaining 11 states as legal proceedings continue.
On September 12, 2024, the EPA was granted a voluntary remand of the GNP record by the D.C. Circuit Court to respond to the assessment that the agency failed to explain how the GNP could function effectively with fewer than the originally intended states. The EPA is expected to justify in the action currently under review how the GNP should move forward even if it is only in effect in some states The “Federal ‘Good Neighbor Plan’ for the 2015 Ozone National Ambient Air Quality Standards” widened interstate air pollution regulations to ensure states fulfill their “good neighbor” obligations under the CAA. The CAA requires additional emission controls for states that significantly contribute to emissions impacting neighboring states’ ability to meet the 2015 National Ambient Air Quality Standards (NAAQS) for ozone, set at 70 parts per billion (ppb).
Final CMMC 2.0 Rule Published
The Department of Defense released the final rule for the Cybersecurity Maturity Model Certification (CMMC) 2.0 program, setting updated cyber protection standards for companies in the defense industrial base (DIB). The CMMC is a program that applies to DIB contractors. It is a unifying standard and new certification model to ensure that DoD contractors properly protect sensitive information. The CMMC combines various cybersecurity standards, such as NIST SP 800-171, NIST SP 800-53, ISO 270001, and ISO 2703, as well as best practices and maps these controls and processes across several maturity levels that range from basic cyber hygiene to advanced.
The CMMC 1.0 model was first established under a interim rule in September 2020. In March 2021, the Department initiated an internal review of CMMC’s implementation, informed by more than 850 public comments in response to the interim DFARS rule. In November 2021, the Department announced CMMC 2.0, an updated program structure and requirements. CMMC 2.0 builds on and refine the original program requirements by streamlining the model from five to three compliance levels, reducing the assessment costs and adding additional flexibility.
The CMMC program is based on a tiered cybersecurity framework that requires defense contractors working with controlled unclassified information (CUI) or federal contract information (FCI) to meet one of three levels of CMMC compliance, depending on the sensitivity of the information. The CMMC 2.0 model is reduced from the five levels contained in CMMC 1.0 model to three levels, to streamline the compliance process for small and medium-sized contractors. The model contained in the final rule establishes three progressively sophisticated levels, depending on the type of information:
- Level 1 | 15 requirements with annual self-assessment & annual affirmation
- Level 2 | 110 requirements (aligned with NIST SP 800-171) with triennial third-party assessment & annual affirmation (triennial self-assessment & annual affirmation for select programs)
- Level 3 | 110+ requirements (based on NIST SP 800-171 and 800-172) with triennial government-led assessment & annual affirmation
The rule also allows DoD program offices to grant Plans of Action & Milestones (POA&Ms) for contractors that don’t meet every required standard to receive a limited conditional certification. DoD says POA&Ms will be granted for “specific requirements as outlined in the rule to allow a business to obtain conditional certification for 180 days while working to meet the NIST standards.”
The CMMC 2.0 rule is effective on December 16, 2024, however CMMC requirements won’t be included in solicitations and contracts until after DoD’s follow-on Defense Federal Acquisition Regulation Supplement (DFARS) rule to implement the CMMC program is finalized, which is expected to be published in early to mid-2025. Once the DFARS rule is effective, the CMMC 2.0 requirements will be implemented incrementally over four year-long phases. During the first implementation phases of the plan, a majority of the CMMC requirements will only require self-assessment. The DoD expects all defense contractors to reach full compliance after seven years.