Skip to main content
background

OIRA (Office of Information and Regulatory Affairs)

The Office of Information and Regulatory Affairs (OIRA) is a division within the Office of Management and Budget (OMB) that reviews significant federal regulations before they are published. OIRA’s regulatory review process directly affects defense contractor compliance timelines — every major acquisition rule, including the CMMC final rule and DFARS cybersecurity amendments, must pass through OIRA review before it can take effect.

What Is OIRA?

OIRA serves as the federal government’s central authority for reviewing Executive Branch regulations, approving government information collection requests, establishing statistical practices, and coordinating federal privacy policy. Established under the Paperwork Reduction Act, OIRA ensures that new regulations are cost-effective, legally sound, and consistent with presidential priorities before they become binding.

OIRA’s Regulatory Review Process

When a federal agency develops a significant regulation — defined as one with an annual economic impact exceeding $200 million or raising novel legal or policy issues — it must submit the rule to OIRA for review under Executive Order 12866. OIRA typically has 90 days to complete its review, during which it assesses the rule’s cost-benefit analysis, evaluates alternatives, and coordinates interagency input. OIRA can return rules for revision, approve them, or negotiate changes with the issuing agency.

OIRA and CMMC Rulemaking

The CMMC program rule (48 CFR Part 204) and the related DFARS amendments both underwent OIRA review before publication. Defense contractors monitoring the regulatory pipeline can track OIRA’s review status through the Unified Agenda and the Office of the Federal Register. A rule entering OIRA review signals that it is approaching finalization, while a rule cleared by OIRA is typically published within weeks.

Why OIRA Matters for Compliance Planning

For defense contractors and compliance professionals, OIRA’s review process is a useful leading indicator of regulatory changes. Tracking when rules enter and exit OIRA review helps organizations estimate when new compliance requirements will become enforceable, plan implementation timelines and budget for upcoming obligations, comment on proposed rules during the public comment period before OIRA final review, and understand the regulatory intent behind new requirements by reviewing OIRA’s published analyses.