Federal Communications Commission—Applicability of the Congressional Review Act to Order on Reconsideration in Protecting the Nation's Communications Systems from Cybersecurity Threats

Decision

Matter of: Federal Communications Commission—Applicability of the Congressional Review Act to Order on Reconsideration in Protecting the Nation's Communications Systems from Cybersecurity Threats

File: B-338053

Date: July 29, 2026

DIGEST

The Federal Communications Commission (FCC) issued an order on reconsideration in an FCC proceeding titled, Protecting the Nation's Communications Systems from Cybersecurity Threats (Cybersecurity Ruling). The Cybersecurity Ruling rescinded an FCC declaratory ruling titled, Protecting the Nation's Communications Systems from Cybersecurity Threats (Declaratory Ruling).

The Congressional Review Act (CRA) requires agencies to submit rules to Congress and the Comptroller General before they take effect. CRA adopts the Administrative Procedure Act's definition of a rule but excludes certain categories of rules from coverage. Although FCC characterized the Cybersecurity Ruling as an order resulting from an adjudication, it rescinded FCC's prior interpretation of the law that required telecommunications carriers to implement specific cybersecurity measures. It also announced FCC's revised interpretation of and policy for carrying out its statutory mandates related to cybersecurity going forward. In these respects, the Cybersecurity Ruling has the characteristics of products of rulemaking rather than adjudication, which involve case-specific, individual determination of a particular set of facts. Accordingly, we conclude that the Cybersecurity Ruling falls within APA's definition of a rule. Further, no CRA exception applies. Therefore, the Cybersecurity Ruling is subject to CRA's submission requirements.

DECISION

On November 21, 2025, the Federal Communications Commission (FCC) released an order on reconsideration in an FCC proceeding titled, Protecting the Nation's Communications Systems from Cybersecurity Threats (Cybersecurity Ruling).[1] We received a congressional request for GAO's legal decision regarding the applicability of the Congressional Review Act (CRA) to FCC's Cybersecurity Ruling.[2] Our practice when rendering decisions is to contact the relevant agencies to obtain factual information and their legal views on the subject of the request.[3]  Accordingly, we reached out to FCC on February 13, 2026, and received FCC's response on February 27, 2026.[4]

BACKGROUND

Communications Assistance for Law Enforcement Act (CALEA)

Congress enacted the Communications Assistance for Law Enforcement Act (CALEA)[5] in 1994 “to require that telecommunications carriers and manufacturers of telecommunications equipment design their equipment, facilities, and services to ensure that they have the necessary surveillance capabilities to comply with legal requests for information.”[6] The statute is “intended to preserve the ability of law enforcement agencies to conduct electronic surveillance while protecting the privacy of information outside the scope of the investigation.”[7]

Section 105 of CALEA provides that “[a] telecommunications carrier shall ensure that any interception of communications or access to call-identifying information effected within its switching premises can be activated only in accordance with a court order or other lawful authorization and with the affirmative intervention of an individual officer or employee of the carrier acting in accordance with regulations prescribed by the Commission.”[8] FCC is charged with prescribing rules to implement CALEA, including rules to implement section 105 that require common carriers to: establish policies and procedures to supervise and control their officers and employees; ensure interceptions or access to call‑identifying information occur only with proper authorization; prevent any interception or access without appropriate authorization; maintain secure and accurate records of any authorized or unauthorized interception or access; and submit to FCC the policies and procedures adopted to comply with these requirements.[9]

January 2025 Declaratory Ruling

On January 16, 2025, FCC released a declaratory ruling and notice of proposed rulemaking in a proceeding titled, Protecting the Nation's Communications Systems from Cybersecurity Threats (Declaratory Ruling).[10] The Declaratory Ruling articulated FCC's interpretation of section 105 of CALEA.[11] FCC explained that the Declaratory Ruling was intended to “clarify that telecommunications carriers' duties under section 105 of CALEA extend not only to the equipment they choose to use in their networks, but also to how they manage their networks.”[12]

Important here, FCC concluded that section 105 of CALEA imposes a statutory obligation on telecommunications carriers to secure their networks from all unauthorized interceptions and access to call‑identifying information, whether by law enforcement or by other parties.[13] Specifically the Declaratory Ruling provided that “telecommunications carriers would be unlikely to satisfy their statutory obligations under section 105 without adopting certain basic cybersecurity practices.”[14] It also explained that carriers must implement measures such as role‑based access controls, changing default passwords, requiring minimum password strength, and adopting multifactor authentication.[15] It further stated that a failure to patch known vulnerabilities or to employ best practices necessary to address identified exploits would fall short of fulfilling this statutory obligation.[16] The Declaratory Ruling stated these measures are “necessary for any sensitive computer system” and that failure to implement such measures may result in noncompliance with statutory obligations.[17] FCC also provided that these measures must be implemented at the enterprise level, rather than solely at the switching premises, in order to be effective.[18]

FCC noted that the Declaratory Ruling clarified its conclusions in an earlier report and order implementing section 105, in which the agency found that “CALEA creates an affirmative obligation for a telecommunications carrier to avoid the risk that suppliers of untrusted equipment will ‘illegally activate interceptions or other forms of surveillance within the carrier's switching premises without its knowledge.'” [19]

Cybersecurity Ruling

Following issuance of the Declaratory Ruling, several industry groups, including CTIA – The Wireless Association, NCTA – The Internet & Television Association, and USTelecom – The Broadband Association (Petitioners), filed a petition for reconsideration, asking FCC to rescind the Declaratory Ruling.[20] On reconsideration, FCC rescinded the Declaratory Ruling after determining that it was both unlawful and ineffective.[21]

More specifically, FCC stated that the Declaratory Ruling was unlawful because it rested on an erroneously expansive interpretation of section 105 of CALEA and ineffective for ignoring the nature of current threats and straying from its proven, cooperative cybersecurity model.[22] FCC explained further that the Declaratory Ruling wrongly expanded a narrow duty to prevent the unlawful interception of communications or access to call-identifying information within telecommunications carriers' switching premises into a broad, network‑wide cybersecurity mandate.[23] FCC also stated that the Declaratory Ruling misconstrued CALEA's definition of “interception” by extending it to attempts to access data at rest, contrary to judicial precedent limiting interception to acquisition of communications contemporaneously with their transmission.[24] For these reasons, FCC determined that the Declaratory Ruling was legally erroneous.[25] FCC reiterated that CALEA confines the agency to rulemaking on specified scenarios and does not permit it to enforce statutory obligations absent duly promulgated regulations.[26]

FCC also explained that it would address cybersecurity through collaboration with carriers and targeted, legally supported regulatory and enforcement measures, which it found more effective than the one‑size‑fits‑all approach adopted in the Declaratory Ruling.[27] FCC concluded that the Declaratory Ruling departed from its longstanding collaborative cybersecurity model and established data‑security standards that should have been issued through notice‑and‑comment rulemaking.[28]

Congressional Review Act (CRA)

CRA, enacted in 1996 to strengthen congressional oversight of agency rulemaking, requires federal agencies to submit a report on each new rule to both houses of Congress and the Comptroller General for review before the rule can take effect.[29] The report must contain a copy of the rule, “a concise general statement relating to the rule,” and the rule's proposed effective date.[30] CRA allows Congress to review and disapprove rules issued by federal agencies for a period of 60 days using special procedures.[31] If a resolution of disapproval is enacted, then the new rule has no force or effect.[32]

CRA adopts the definition of a rule under the Administrative Procedure Act (APA), which states that a rule is “the whole or a part of an agency statement of general or particular applicability and future effect designed to implement, interpret, or prescribe law or policy or describing the organization, procedure, or practice requirements of an agency.”[33] However, CRA excludes three categories of APA rules from coverage: (1) rules of particular applicability; (2) rules relating to agency management or personnel; and (3) rules of agency organization, procedure, or practice that do not substantially affect the rights or obligations of non‑agency parties.[34]

FCC did not submit a CRA report to Congress or the Comptroller General for the Cybersecurity Ruling.[35] In its response to us, FCC appears to contend that the Cybersecurity Ruling is not a rule under CRA because it was issued pursuant to FCC's authority to reconsider a prior Declaratory Ruling that it characterizes as an adjudicatory action.[36] FCC also states that the Cybersecurity Ruling neither adopts nor rescinds any rules, but instead rescinds the Declaratory Ruling's interpretation that FCC could announce what the statute requires without issuing implementing regulations.[37] Lastly, FCC states the rescission of the rule reflects a return to the status quo.[38]

DISCUSSION

At issue here is whether the Cybersecurity Ruling meets CRA's definition of a rule, which adopts APA's definition of a rule, with three exceptions. As explained below, we conclude that it does and that no exceptions apply. Consequently, the Cybersecurity Ruling is subject to review under CRA.

The Cybersecurity Ruling is a Rule under APA

Applying APA's definition of a rule, the Cybersecurity Ruling meets all the required elements. First, the Cybersecurity Ruling is an agency statement as it was issued by FCC, a federal agency.[39]

Second, the Cybersecurity Ruling is of general applicability and future effect. The Declaratory Ruling applied to all “telecommunications carriers” subject to CALEA. By rescinding the requirements imposed by the Declaratory Ruling on telecommunications carriers and announcing a new policy to address how it will implement cybersecurity going forward, the Cybersecurity Ruling continues to apply to the same broad class of regulated entities.[40] Through these actions, FCC establishes the framework that will govern its administration of CALEA going forward.

Lastly, the Cybersecurity Ruling interprets law and prescribes agency policy. An agency action implements, interprets, or prescribes law or policy when the action issues new regulations, changes regulatory requirements or official policy, or alters how the agency will exercise its discretion, among other things.[41] Here, FCC not only rescinded the statutory interpretations and the resulting obligations on telecommunications carriers announced in the Declaratory Ruling, but it also adopted a revised interpretation of CALEA that establishes the limits of its authority, the scope of the statute, and its policy for implementing CALEA going forward.[42]

The Cybersecurity Ruling supports our conclusion as it also provides that the Declaratory Ruling implemented a policy change that abandoned FCC's past practice and “represented a drastic departure from data security standards”[43] and that the Cybersecurity Ruling “return[s] matters to the status quo ante.”[44] Read together, these actions support the conclusion that the Cybersecurity Ruling interprets and prescribes policy. Having satisfied all the required elements, the Cybersecurity Ruling meets APA's definition of a rule.

FCC's Response

FCC appears to assert that the Cybersecurity Ruling is not a rule under CRA because it was issued as an order on reconsideration of its Declaratory Ruling and, in FCC's view, both actions are orders arising from an adjudication rather than rulemaking.[45] FCC explains that it issued the Declaratory Ruling under its regulations governing such proceedings, 47 C.F.R. § 1.2.[46] This provision provides that FCC may, “in accordance with section 5(d) of the [APA],” issue a declaratory ruling to terminate a controversy or remove uncertainty.[47] Section 5(d) of the APA, codified at 5 U.S.C. § 554(e), similarly provides that an agency, “in its sound discretion,” may issue a “declaratory order” to terminate a controversy or remove uncertainty.[48] Because section 554(e) is part of APA's framework for adjudications, courts have treated declaratory orders issued under it as informal adjudications.[49] And FCC has long labeled these actions “declaratory rulings.”[50]

FCC explained further that it relied on sections 4(j) and 405 of the Communications Act as the procedural basis for reconsidering the Declaratory Ruling and issuing the Cybersecurity Ruling.[51] Section 405 authorizes FCC to reconsider “an order, decision, report, or action.” And the Cybersecurity Ruling cites to its regulations under section 1.106 of title 47, which governs petitions for reconsideration in non‑rulemaking proceedings as its authority for rescinding the Declaratory Ruling.[52] Section 4(j) authorizes FCC to “conduct its proceedings in such manner as will best conduce to the proper dispatch of business and to the ends of justice.”[53]

We have not previously addressed whether an agency action styled as a declaratory order may constitute a rule under APA. We therefore look to the APA, which provides for the definitions of relevant terms, as well as judicial precedent on declaratory orders and our prior decisions addressing how we distinguish between adjudications, orders, rulemaking, and rules.[54]

As explained above, CRA incorporates APA's definition of a rule.[55] Under that definition, a rule is an agency statement of general or particular applicability and future effect designed to implement, interpret, or prescribe law or policy or describes the organization, procedure, or practice requirements of an agency.[56] And “rule making” means the agency process for formulating, amending, or repealing a rule.[57] APA also defines an “order” as the whole or a part of a final disposition, whether affirmative, negative, injunctive, or declaratory in form, in a matter other than rulemaking.[58] Orders arise from adjudications,[59] which involve applying existing statutory or regulatory standards to particular facts to determine the rights or obligations of identified parties.[60]

The Fifth Circuit's analysis in City of Arlington v. FCC, 668 F.3d 229 (5th Cir. 2012) provides a test for determining whether an action issued through a declaratory ruling may nonetheless function as rule under APA. There the court considered an FCC declaratory ruling and related reconsideration order.[61] The declaratory ruling established timelines for state and local governments to take action on applications from interested parties to construct, modify, or collocate wireless service facilities.[62] The petitioners seeking reconsideration asserted that FCC's action was a rulemaking and that it had improperly established the timelines through the declaratory ruling rather than rulemaking.[63] In addressing that argument, the court determined that the declaratory ruling was the product of adjudication but explained that, although agencies generally possess broad discretion to choose between rulemaking and adjudication, that discretion remains bounded by the requirements of the APA.[64]

To determine whether FCC abused its discretion in establishing the timelines through adjudication rather than rulemaking, the court assessed the characteristics of FCC's action. [65] In doing so, the court concluded that FCC's declaratory ruling bore “all the hallmarks of products of rulemaking.”[66] The court contrasted adjudications which typically "resolve disputes among specific individuals in specific cases,” with rulemaking, which “affects the rights of broad classes of unspecified individuals."[67] The court also acknowledged that declaratory orders may be used to remove uncertainty or provide clarity of the law, but suggested that, even then, they must address “concrete and narrow questions of law the resolution[] of which would have an immediate and determinable impact on specific factual scenarios.”[68]

For example, the court noted that the D.C. Circuit upheld FCC's use of a declaratory ruling to classify specific prepaid calling cards as regulated telecommunications services in Qwest Services Corp. v. FCC, and that in Chisholm v. FCC, the D.C. Circuit determined that FCC properly used a declaratory ruling to clarify how the Communications Act's equal‑time provision applied to specific types of candidate appearances.[69] The City of Arlington court cited both decisions as examples of declaratory rulings that resolved “concrete and narrow questions of law the resolutions of which would have an immediate and determinable impact on specific factual scenarios.”[70]

By contrast, FCC's actions in the City of Arlington case illustrate the improper use of a declaratory ruling.[71] There, FCC issued a declaratory ruling interpreting the law to impose timelines for the processing of applications on every state and local government nationwide.[72] The court explained that this action was “utterly divorced from any specific application of the statute” and its effect would not be known until the adjudication of a suit addressing a question of law arising from the statue.[73] Accordingly, the court stated that the action was classic rulemaking.[74]

Our decisions distinguishing rules from orders are also instructive and in line with the principles discussed in the City of Arlington. Our decisions have emphasized that adjudications are “case‑specific, individual determination[s] of a particular set of facts that ha[ve] immediate effect on the individual(s) involved.”[75] In B‑334644, Mar. 17, 2023, we considered whether the Department of Education's (ED) actions waiving and modifying certain provisions of the Higher Education Act and its implementing regulations for student loan borrowers constituted a rule or an order.[76] We evaluated whether these actions aligned more closely with rulemaking, which would result in a rule, or an adjudication, which would result in an order.[77]

ED argued that these actions were orders because they applied to existing loans and implemented statutory authority in response to specific circumstances.[78] We disagreed.[79] ED's actions applied to all individuals with federal direct loans or federally held loans, having broad consequences for all borrowers, not just a specific defined subset.[80] They did not apply existing law to the facts of any particular claim or request nor did they resolve discrete licenses, petitions, applications, or party‑specific requests.[81] Instead, ED's actions established, prospectively, new rights and obligations for student loan borrowers and loan holders.[82]

In reaching that conclusion, we distinguished ED's actions from what occurred in Goodman v. FCC, 182 F.3d 987 (D.C. Cir. 1999). In Goodman, FCC adjudicated requests for temporary waivers of existing requirements applicable to licenses that had already been issued.[83] The D.C. Circuit treated the action as an order because it resolved waiver requests under existing rules rather than formulating or amending generally applicable and prospective requirements.[84] By contrast, we have recognized that agency actions establishing standards of general applicability and future effect constitute rulemaking even where they modify existing licenses or other legal rights.[85]

We applied similar reasoning in a decision concerning the Environmental Protection Agency (EPA). In B-334400, Feb. 9, 2023, EPA applied its interpretation of existing law to the facts presented in 69 small refinery exemption petitions.[86] Despite the number of petitioners, we concluded that EPA's resolution of the petitions was an order, not a rule, because each petition sought an individual “statutory exemption,” which APA recognizes as a type of license.[87] Accordingly, EPA's denial of the petitions for statutory exemption resolved discrete exemption requests under an existing statutory framework.[88]

In another example, B-337960, Apr 9, 2026, we concluded that an agency letter was an order, not a rule, even though it included the agency's interpretation of relevant statutes and regulations, because the letter applied those statutory and regulatory provisions to specific facts and had an immediate effect on the particular entity that requested the letter.

These authorities turn on the same distinction. An agency action is more properly characterized as an order resulting from adjudication than a rule resulting from rulemaking when the agency interprets and applies existing legal standards to a discrete set of facts, typically presented through party‑specific petitions such as applications for licenses, exemptions, waivers, or other individualized petitions.[89] In addition, declaratory orders may be used to clarify existing law or remove uncertainty when they involve “concrete and narrow questions of law the resolution of which would have an immediate and determinable impact on specific factual scenarios,” but they exceed that purpose when used to announce broad, prospective requirements that are untethered to any particular application of the law to a discrete set of facts.[90] This substance‑over‑form approach ensures that APA's definition of a rule is not defeated by an agency's chosen label or procedural vehicle.

Here, like FCC's action in City of Arlington, the substance and effect of the Declaratory Ruling is characteristic of rulemaking, not adjudication.[91] The Cybersecurity Ruling itself confirms this—FCC recognized that the Declaratory Ruling imposed requirements on all telecommunications carriers and expressly stated that such action should have been adopted through rulemaking.[92] In substance, the Declaratory Ruling announced FCC's cybersecurity policy, interpreted section 105 of CALEA, and established generally applicable standards governing how telecommunications carriers must satisfy their statutory obligations going forward. This kind of broad, prospective policy setting is the hallmark of rulemaking, which includes agency statements of general applicability designed to implement, interpret, or prescribe law or policy.[93] By contrast, declaratory orders are properly used only to clarify existing law or remove uncertainty in the context of a concrete, narrowly framed legal question with an immediate and determinable impact on a specific factual scenario.

Although FCC framed the Cybersecurity Ruling as an order on reconsideration that merely corrected an interpretive error, the substance of the action does not satisfy the standard for adjudications, which are “case‑specific, individual determination[s] of a particular set of facts that ha[ve] immediate effect on the individual(s) involved.”[94] Rather, it addressed broad policy and interpretive questions: including the scope of CALEA section105, the validity of the prior FCC statutory interpretation, and how it will implement the statute going forward.[95] As City of Arlington explains, when an agency proceeds through adjudication, it may abuse its discretion to do so if the substance of the action bears “all the hallmarks of products of rulemaking.”[96] As the Supreme Court has recognized, “the critical feature of interpretive rules is that they are ‘issued by an agency to advise the public of the agency's construction of the statutes and rules which it administers,'” underscoring that substance—not procedural form—determines whether an action functions as a rule.[97] 

Here, FCC rescinded the Declaratory Ruling which it acknowledges should have been issued through notice and comment. In addition, FCC set forth its current interpretation of CALEA and the Communications Act and its policy and cybersecurity objectives.[98] Because the Cybersecurity Ruling rescinded a prior action that itself functioned as a rule and replaced it with a revised interpretation of and policy for implementing the statutes it administers, it operates as an agency statement of general applicability designed to implement and interpret law and policy and therefore constitutes a rule under APA.

CRA Exceptions

We must next determine whether any of CRA's three exceptions apply. CRA provides for three types of rules that are not subject to its requirements: (1) rules of particular applicability; (2) rules relating to agency management or personnel; and (3) rules of agency organization, procedure, or practice that do not substantially affect the rights or obligations of non-agency parties.[99]

1) Rule of Particular Applicability

First, the Cybersecurity Ruling is a rule of general applicability, rather than particular applicability. Rules of particular applicability are rules addressed to specific, identified persons or entities and determine actions that person or entity may or may not take, considering facts and circumstances specific to those persons or entities.[100] The Cybersecurity Ruling is not limited to a single person or entity as it rescinded the Declaratory Ruling that applied to all telecommunications carriers and announced policy changes and guidance that apply broadly to all telecommunications carriers.[101]

2) Rule of Agency Management or Personnel

The Cybersecurity Ruling is not a rule of agency management or personnel. We have previously found that rules that fall into this category relate to purely internal agency matters.[102] These include rules related to controlling, directing, or supervising internal management issues, as well as those related to personnel issues like communications between employees and managers, leave, or benefits.[103] The Cybersecurity Ruling rescinds the Declaratory Ruling which it described as imposing requirements on regulated parties.[104] It also set forth FCC's interpretation of CALEA and announces its policy for addressing its statutory obligations concerning cybersecurity going forward.[105] Because the Cybersecurity Ruling primarily addresses the legal framework applicable to non-agency parties, it is not a rule of agency management or personnel.

3) Rule of Agency Organization, Procedure, or Practice that Does Not Substantially Affect Non-Agency Parties

Lastly, the Cybersecurity Ruling is not a rule of agency organization, procedure, or practice that does not substantially affect the rights or obligations of non‑agency parties.[106] CRA's third exception was modeled on a similar APA exception, which excludes “rules of agency organization, procedure, or practice” from notice‑and‑comment requirements.[107] Accordingly, we look to APA case law concerning this exception for guidance.[108] Some courts have explained that the purpose of this exception is to ensure “that agencies retain latitude in organizing their internal operations,”[109] but only where such rules do not have a “substantial impact” on non‑agency parties.[110]

Following this principle in the CRA context, we have only applied CRA's third exception to rules that primarily focus on the internal operations of an agency. For example, in B-329926, Sept. 10, 2018, we found that updates to a Social Security Administration (SSA) hearing manual governing SSA adjudicators' use of information from the internet was a rule of agency organization, procedure, or practice. There, the manual outlined procedures for SSA employees to follow in processing and adjudicating benefits claims.[111] Because the manual was directed to and binding only on SSA officials without imposing new burdens on claimants, we concluded that the manual met CRA's third exception.[112]

By contrast, rules that are directed at and primarily concern the behavior of non‑agency parties do not fall within this category.[113] For instance, in B‑337604, Dec. 16, 2025, we determined that a policy notice prescribing actions program participants should and should not take in carrying out a federal grant program did not fall within this exception because it primarily concerned the behavior of non‑agency parties rather than the internal operations of the agency.

Here, the Cybersecurity Ruling does entail changes to agency practice by establishing how FCC will interpret and administer CALEA going forward, including its determination that cybersecurity‑related obligations must be imposed through rulemaking rather than direct enforcement of the statute.[114] Additionally, the Cybersecurity ruling was initiated by a petition for reconsideration filed by non‑agency parties seeking relief from the requirements imposed by the Declaratory Ruling,[115] and FCC rescinded the Declaratory Ruling, thereby extinguishing the across‑the‑board requirements it imposed on all telecommunications carriers.[116] In sum, the Cybersecurity Ruling announces to the public FCC's interpretation of the statutes it administers going forward, explains the scope of its authority, sets out how the agency will carry out its cybersecurity mandate in working with telecommunications carriers, and rescinds the Declaratory Ruling which imposed obligations on regulated entities.[117] These changes primarily concern FCC's interactions with regulated entities; thus, the Cybersecurity Ruling extends beyond internal agency operations. Therefore, the Cybersecurity Ruling is not a rule of agency organization, procedure, or practice.

Under our analysis of the third exception, we also consider whether the Cybersecurity Ruling substantially affects the rights or obligations of non‑agency parties, as an action that substantially alters those rights or obligations cannot qualify as a rule of agency organization, procedure, or practice. When considering whether the rule substantially affects the rights and obligations of non-agency parties, the critical question is whether the agency's action alters the rights or interests of regulated entities.[118] Courts have similarly determined that an agency rule that modifies substantive rights and interests can only be nominally procedural.[119] For example, we have previously concluded that agency actions that withdraw operative requirements and prompt regulated entities to change their compliance posture have a substantial impact on non‑agency parties. In B‑337935, May 12, 2026, we concluded that the Department of Commerce's action effectively suspended licensing and compliance obligations, thereby altering the rights and duties of regulated entities. Likewise, in B‑337673, Jan. 16, 2026, we concluded that the National Credit Union Administration's withdrawal of a reporting requirement changed the compliance framework for affected credit unions and thus substantially affected non‑agency parties.

The Cybersecurity Ruling similarly alters the compliance framework applicable to telecommunications carriers. By rescinding the Declaratory Ruling's interpretation of CALEA and removing the immediate cybersecurity‑related obligations that flowed from that interpretation, FCC changed the legal landscape governing how carriers assess and satisfy their statutory duties.[120] FCC's statement that it will instead address cybersecurity through “collaboration with carriers, coupled with targeted, legally robust regulatory and enforcement measures” further confirms that the agency has adopted a different practice for carrying out its statutory obligations related to cybersecurity.[121] These changes affect the compliance obligations of telecommunications carriers. Because the Cybersecurity Ruling substantially affects non‑agency parties, it does not fall within CRA's third exception.

CONCLUSION

The Cybersecurity Ruling is a rule for purposes of CRA because it rescinds generally applicable compliance requirements for telecommunications carriers, establishes FCC's current framework for implementing CALEA, and carries prospective consequences for all carriers subject to the statute. As such, it constitutes a rule under the APA, rather than an adjudicatory order, and no CRA exception applies. Therefore, the Cybersecurity Ruling is subject to the CRA requirement that it be submitted to Congress and the Comptroller General before taking effect.

Edda Emmanuelli Perez
General Counsel

---