Cybersecurity Policy Report, Draft Bill Aims to Force Independent Agencies to Harmonize Cyber Rules, (Jun 5, 2024)
Draft legislation that would force independent regulatory agencies to work with the White House to harmonize sector-specific cybersecurity regulations is being developed by Sen. Gary Peters (D., Mich), Sen. Peters disclosed today.
Sen. Peters, chairman of the Senate Homeland Security and Governmental Affairs Committee, discussed his draft Cybersecurity Regulation Harmonization Act during a committee hearing today titled “Streamlining the Federal Cybersecurity Regulatory Process: The Path to Harmonization.”
“In the last four years alone, federal regulators have passed 48 rules on cybersecurity—more than 10 per year—and that doesn’t include new policies at the state as well as the local level,” Sen. Peters said.
“The surge of regulations comes from a good place. It represents our government’s response to a new and growing threat that has helped give American businesses some important guidance on how to keep safe from these cyber threats,” he said.
“The challenge is that, even though all aspects of our society are vulnerable to cyber attacks—from electric grids to water systems to gas pipelines—no one is coordinating this effort. This is a patchwork of new guidelines set by separate agencies,” he added.
“Without that higher level of coordination, there is no way to ensure that these guidelines don’t overlap, duplicate, or, quite simply, contradict each other. The results are often confusing and inefficient,” Sen. Peters noted.
“In short, businesses and their employees are spending too many resources trying to understand these new guidelines. Companies are taking their cybersecurity professionals off the line to fill out paperwork, leaving their defenses undermanned and vulnerable,” he said.
He announced he was “working on legislation to establish a harmonization committee” at the White House Office of the National Cyber Director (ONCD) that would require “all agencies and regulators to come together, talk about cybersecurity regulations, and work on harmonization.”
“Passing legislation is the only solution. We have to bring independent agencies together and start harmonizing this effort. Only Congress has the power to do so, and if we fail at this mission, we won’t be able to build the most effective response to cyber threats,” he said.
Sen. Peters’ draft legislation would require all independent regulatory agencies and sector risk management agencies to participate in ONCD’s harmonization committee.
The committee would have one year to “develop a regulatory framework for achieving harmonization between each regulatory agency regarding regulations that contain requirements relating to information security or cybersecurity,” according to the draft bill’s text.
In addition to harmonization, the framework should establish a “reciprocal compliance mechanism for baseline requirements relating to information security or cybersecurity for entities regulated by more than 1 regulatory agency,” the draft bill says.
The draft bill defines reciprocity as “the recognition or acceptance by 1 regulatory agency of an assessment, determination, finding, or conclusion of another regulatory agency with respect to the extent that a regulated entity has complied with certain requirements or guidance relating to information security or cybersecurity.”
The Biden administration “supports the approach that Chairman Peters has laid out” in the draft bill, according to Nicholas Leiserson, ONCD’s assistant national cyber director–cyber policy and programs.
The ONCD has been working on cyber regulatory harmonization and reciprocity, which are among the goals of the National Cybersecurity Strategy issued by the White House last year, Mr. Leiserson told the committee.
In a blog post yesterday, National Cyber Director Harry Coker explained what ONCD was doing to harmonize cybersecurity regulations and said legislation was needed to require independent agencies to participate in harmonization efforts (CPR, June 4).
Neither ONCD nor the Office of Management and Budget have clear statutory authority to require independent agencies to collaborate on regulatory harmonization, Mr. Leiserson testified.
“We basically have a coalition of the willing. We have the folks who want to come to the table, who believe that this is an important problem and have a conversation about it,” he told the committee.
“But having a clear mandate from Congress to bring everyone to the table will let us do what we do best at ONCD, which is listen to our partners, work with them to address the challenges, and design a comprehensive framework that allows for harmonization but, just as importantly, reciprocity—the idea that once I’ve proven as an entity that I’ve met the requirements once, I do not need to do so again, no matter how many regulators are asking the same questions,” he said.
Harmonization is an easier task with cybersecurity regulations, Mr. Leiserson said in his written testimony, because every type of business uses similar information and communications technology that cyber attackers target.
“Banks and water treatment plants have different business, environmental, and national security regulations because the risks to each for those sectors are different,” he noted. “But this all changes for cybersecurity regulations.”
“Cybersecurity controls on information and communications technology (ICT) are unique in that, for many common enterprise ICTs, both the technology and the risk being managed are consistent across sectors,” he said.
“For both banks and water treatment plants, how we define and require access controls should be the same for each because the risk being addressed is the same: preventing unauthorized access. While there are certainly sector-specific technologies that need to be accounted for, business systems across sectors are more similar than different,” he said.
“For regulated entities, harmonized and reciprocal cybersecurity oversight approaches would decrease the administrative burden tied to varying or redundant regulatory requirements for similar functions,” he added. “Through eliminating differing requirements and duplicative examinations, regulated entities could instead devote those additional resources and effort to improving their cybersecurity posture.”
MainStory: TopStory DataSecurity FederalLegislation