GAO Finds Duplicative Federal Cybersecurity Reporting Rules
Summary
A GAO study found duplicated reporting requirements in 80 of 117 federal cybersecurity rules across 37 agencies. Harmonization efforts have made limited progress, while CIRCIA could add reporting duties for major attacks and ransomware payments.
Key points
- GAO found that 80 of 117 federal cybersecurity rules contain reporting requirements duplicated by other rules.
- The study examined regulations across 37 federal agencies and focused on reports the private sector must submit to agencies.
- Some critical infrastructure sectors may face overlapping requirements from multiple agencies.
- Pending CIRCIA rules would require critical infrastructure owners and operators to report major attacks and ransomware payments.
- GAO said federal efforts to harmonize conflicting requirements have faced delays and made limited progress.
Article Details
- Event Type
- Government Accountability Office report on overlapping federal cybersecurity reporting requirements
- Impact
- GAO found that 80 of 117 federal cybersecurity rules across 37 agencies contain duplicated reporting requirements. The overlap creates compliance burdens for private-sector organizations, including some critical infrastructure and financial services entities. Harmonization efforts have faced delays and limited progress; pending CIRCIA rules could add incident and ransomware-payment reporting duties.
People
Industries
Critical infrastructureSome critical infrastructure sectors face overlapping requirements from multiple agencies.Financial ServicesElements of the financial services sector might fall under one of 15 preexisting cybersecurity reporting rules, depending on the agency that has oversight, but they may also be subject to the pending CIRCIA rules, GAO