Skip to main content

🔔 Notifications Hub: See compliance updates in one place

OIRA (Office of Information and Regulatory Affairs)

OIRA is the division of OMB that reviews significant federal regulations before they are published. Every major cybersecurity rule that affects defense contractors (CMMC, DFARS amendments, the FAR CUI rule) goes through OIRA. Tracking OIRA's review status is one of the best leading indicators for when a compliance requirement will actually hit your contracts.

What OIRA Reviews

Executive Order 12866 requires OIRA review for any 'significant regulatory action.' The definition includes rules with an annual economic impact of $200 million or more, rules that create a serious inconsistency with another agency's action, rules that materially alter the budget impact of entitlements, or rules that raise novel legal or policy issues. Most cybersecurity rules of any real scope meet at least one of these thresholds.

The Review Process

An agency finishes drafting a rule and submits it to OIRA. OIRA has 90 days to review. During review, OIRA coordinates with other agencies, evaluates the cost-benefit analysis, and may negotiate changes. OIRA can approve, return for reconsideration, or withdraw the rule from review. Once OIRA approves, publication in the Federal Register follows within weeks.

How to Track OIRA Review

  • reginfo.gov/public/do/eoDashboard: The live dashboard of rules currently at OIRA.
  • OIRA's Regulatory Information Service Center publishes the Unified Agenda twice a year showing planned rulemaking.
  • The CMMC Program Rule, the FAR CUI Rule, and various DFARS amendments all showed up on the Unified Agenda a year or more before they were published.

Why OIRA Matters for Compliance Planning

If you want to know when a major cybersecurity rule will land, OIRA is the last gate. Once a rule clears OIRA, assume it will be published soon. That is your window to finalize implementation before the requirement is enforceable. Tracking OIRA also lets you see which rules are stalling and why, which informs how you plan compliance programs and budgets.