Cybersecurity Policy Report, Rep. Higgins to Revisit Cyber Regulatory Harmonization in 119th Congress, (Jan 22, 2025)
Legislation that would harmonize the federal government’s cybersecurity regulations by establishing a “harmonization committee” within the White House Office of the National Cyber Director (ONCD) should be a priority for the 119th Congress, according to Rep. Clay Higgins (R., La.).
In the last Congress, Rep. Higgins sponsored the House version of the Streamlining Federal Cybersecurity Regulations Act, which would have directed the ONCD to lead a committee to develop a framework to ease the regulatory burden on critical infrastructure entities that often face duplicative—and sometimes conflicting—cybersecurity mandates from multiple federal agencies (TR Daily, Nov. 18, 2024).
A Senate version of the bill was introduced last Congress by Sen. Gary Peters (D., Mich.) and James Lankford (R., Okla.).
“We are, indeed, reintroducing that legislation in the 119th Congress,” Rep. Higgins said today at a hearing of the House Homeland Security Committee.
“We should move forward with that legislation because it allows the industry sectors to appropriately position themselves to spend less time and money in compliance with regulatory oversight and more of their energy and focus on actually accomplishing their mission as it regards cybersecurity,” he said.
Two witnesses at the hearing offered support for the legislation.
Kemba Walden, former acting director of the ONCD, noted that during her tenure at ONCD the office issued a request for information that sought input on the cybersecurity regulatory burdens faced by the private sector (TR Daily, July 20, 2023).
“What we heard was startling,” Ms. Walden told the committee in her written testimony. “Businesses of all sizes and from 11 of the 16 critical infrastructure sectors reported that the compliance burden was hampering their cybersecurity programs.”
“One industry group reported that CISOs [chief information security officers] were spending 30 to 50 percent of their time focused on compliance. This is not only a drain on our economy—it actually leaves us less secure, by keeping cyber operators filling out paperwork instead of defending systems,” she testified.
The approach that would have been required by Rep. Higgins’ bill would have improved the nation’s “cybersecurity posture” and reduced “compliance costs,” Ms. Walden said.
“I hope Congress will continue last year’s momentum and move swiftly to enact this legislation,” she added.
Another witness, Mark Montgomery, senior director of the Center on Cyber and Technology Innovation at the Foundation for Defense of Democracies, agreed that a patchwork of cybersecurity mandates from state and federal agencies was ineffective at improving cyber defenses.
“When companies demonstrate to one set of regulators that they comply with one set of cybersecurity requirements, the companies should not then have to demonstrate the same facts again to a second regulatory body,” Mr. Montgomery said in his written testimony.
“Restarting efforts” to pass cyber regulatory harmonization legislation “in the 119th Congress should be a priority,” he said.
MainStory: TopStory DataSecurity FederalLegislation