I 

118TH CONGRESS 

2D SESSION H. R. 10123 

To establish an interagency committee to harmonize regulatory regimes in 

the United States relating to cybersecurity, and for other purposes. 

IN THE HOUSE OF REPRESENTATIVES 

NOVEMBER 14, 2024 

Mr. HIGGINS of Louisiana introduced the following bill; which was referred 

to the Committee on Oversight and Accountability, and in addition to the 

Committee on Homeland Security, for a period to be subsequently determined by the Speaker, in each case for consideration of such provisions 

as fall within the jurisdiction of the committee concerned 

A BILL 

To establish an interagency committee to harmonize regulatory regimes in the United States relating to cybersecurity, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Streamlining Federal 

5 Cybersecurity Regulations Act’’. 

6 SEC. 2. DEFINITIONS. 

7 In this Act: 


ssavage on LAPJG3WLY3PROD with BILLS
2 

•HR 10123 IH

1 (1) AGENCY.—The term ‘‘agency’’ has the 

2 meaning given that term in section 551 of title 5, 

3 United States Code. 

4 (2) APPROPRIATE CONGRESSIONAL COMMIT5 TEES.—The term ‘‘appropriate congressional com6 mittees’’ means— 

7 (A) the Committee on Homeland Security 

8 and Governmental Affairs of the Senate; 

9 (B) the Committee on Oversight and Ac10 countability of the House of Representatives; 

11 (C) each committee of Congress with juris12 diction over the activities of a regulatory agen13 cy; and 

14 (D) each committee of Congress with juris15 diction over the activities of a Sector Risk Man16 agement Agency with respect to a sector regu17 lated by a regulatory agency. 

18 (3) COMMITTEE.—The term ‘‘Committee’’ 

19 means the Harmonization Committee established 

20 under section 3(a). 

21 (4) CYBERSECURITY REQUIREMENT.—The term 

22 ‘‘cybersecurity requirement’’ means an administra23 tive, technical, or physical safeguard, requirement, 

24 or supervisory activity, including regulations, guid25 ance, bulletins, or examinations, relating to informaVerDate Sep 11 2014 01:14 Nov 15, 2024 Jkt 059200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\H10123.IH H10123

ssavage on LAPJG3WLY3PROD with BILLS
3 

•HR 10123 IH

1 tion security, security of information technology or 

2 operational technology, cybersecurity, or cyber risk 

3 or resilience. 

4 (5) HARMONIZATION.— 

5 (A) DEFINITION.—The term ‘‘harmoni6 zation’’ means the process of aligning cyberse7 curity requirements issued by regulatory agen8 cies such that the requirements consist of— 

9 (i) a common set of minimum require10 ments that may apply across sectors and 

11 that can be updated periodically to address 

12 new or evolving risks relating to informa13 tion security or cybersecurity; and 

14 (ii) sector-specific requirements, which 

15 may include performance-based require16 ments, that— 

17 (I) are necessary to address sec18 tor-specific risks that are not ade19 quately addressed by the minimum re20 quirements described in clause (i); 

21 and 

22 (II) are substantially similar, 

23 where appropriate, to other require24 ments in that sector or a similar sec25 tor. 


ssavage on LAPJG3WLY3PROD with BILLS
4 

•HR 10123 IH

1 (B) RULE OF CONSTRUCTION.—Nothing in 

2 this definition shall be construed to exempt reg3 ulatory agencies from any otherwise applicable 

4 processes or laws relating to updating regula5 tions, including subchapter II of chapter 5, and 

6 chapter 7, of title 5, United States Code (com7 monly known as the ‘‘Administrative Procedure 

8 Act’’). 

9 (6) INDEPENDENT REGULATORY AGENCY.—The 

10 term ‘‘independent regulatory agency’’ has the 

11 meaning given that term in section 3502 of title 44, 

12 United States Code. 

13 (7) RECIPROCITY.—The term ‘‘reciprocity’’ 

14 means the recognition or acceptance by 1 regulatory 

15 agency of an assessment, determination, examina16 tion, finding, or conclusion of another regulatory 

17 agency for determining that a regulated entity has 

18 complied with a cybersecurity requirement. 

19 (8) REGULATORY AGENCY.—The term ‘‘regu20 latory agency’’ means— 

21 (A) any independent regulatory agency 

22 that has the statutory authority to issue or en23 force any mandatory cybersecurity requirement; 

24 or 


ssavage on LAPJG3WLY3PROD with BILLS
5 

•HR 10123 IH

1 (B) any other agency that has the statu2 tory authority to issue or enforce any cyberse3 curity requirement. 

4 (9) REGULATORY FRAMEWORK.—The term 

5 ‘‘regulatory framework’’ means the framework devel6 oped under section 3(e)(1). 

7 (10) SECTOR RISK MANAGEMENT AGENCY.— 

8 The term ‘‘Sector Risk Management Agency’’ has 

9 the meaning given that term in section 2200 of the 

10 Homeland Security Act of 2002 (6 U.S.C. 650). 

11 SEC. 3. ESTABLISHMENT OF INTERAGENCY COMMITTEE TO 

12 HARMONIZE REGULATORY REGIMES IN THE 

13 UNITED STATES RELATING TO CYBERSECU14 RITY. 

15 (a) HARMONIZATION COMMITTEE.— 

16 (1) IN GENERAL.—The National Cyber Director 

17 shall establish an interagency committee to be 

18 known as the Harmonization Committee to enhance 

19 the harmonization of cybersecurity requirements 

20 that are applicable within the United States. 

21 (2) SUPPORT.—The National Cyber Director 

22 shall provide the Committee with administrative and 

23 management support as appropriate. 

24 (b) MEMBERS.— 


ssavage on LAPJG3WLY3PROD with BILLS
6 

•HR 10123 IH

1 (1) IN GENERAL.—The Committee shall be 

2 composed of— 

3 (A) the National Cyber Director; 

4 (B) the head of each regulatory agency; 

5 (C) the head of the Office of Information 

6 and Regulatory Affairs of the Office of Manage7 ment and Budget; and 

8 (D) the head of other appropriate agencies, 

9 as determined by the chair of the Committee. 

10 (2) PUBLICATION OF LIST OF MEMBERS.—The 

11 Committee shall maintain, on a publicly available 

12 website, a list of the agencies that are represented 

13 on the Committee, and shall update the list as mem14 bers are added or removed. 

15 (c) CHAIR.—The National Cyber Director shall be 

16 the chair of the Committee. 

17 (d) CHARTER.—The Committee shall develop, deliver 

18 to Congress, and make publicly available a charter, which 

19 shall— 

20 (1) include the processes and rules of the Com21 mittee; and 

22 (2) detail— 

23 (A) the objective and scope of the Com24 mittee; and 

25 (B) other items as necessary. 


ssavage on LAPJG3WLY3PROD with BILLS
7 

•HR 10123 IH

1 (e) REGULATORY FRAMEWORK FOR HARMONI2 ZATION.— 

3 (1) IN GENERAL.— 

4 (A) FRAMEWORK.— 

5 (i) IN GENERAL.—Not later than 1 

6 year after the date of enactment of this 

7 Act, the Committee shall develop a regu8 latory framework for achieving harmoni9 zation of the cybersecurity requirements of 

10 each regulatory agency. 

11 (ii) DEVELOPMENT.—The process for 

12 developing such regulatory framework shall 

13 include the opportunity for public comment 

14 and consultation with industry experts and 

15 other stakeholders. 

16 (B) FACTORS.—In developing the frame17 work under subparagraph (A), the Committee 

18 shall account for existing sector-specific cyber19 security requirements that are identified as 

20 unique or critical to a sector. 

21 (2) MINIMUM REQUIREMENTS.—The framework 

22 shall contain, at a minimum, processes for— 

23 (A) establishing a reciprocal compliance 

24 mechanism for minimum requirements relating 

25 to information security or cybersecurity for enVerDate Sep 11 2014 01:14 Nov 15, 2024 Jkt 059200 PO 00000 Frm 00007 Fmt 6652 Sfmt 6201 E:\BILLS\H10123.IH H10123

ssavage on LAPJG3WLY3PROD with BILLS
8 

•HR 10123 IH

1 tities regulated by more than 1 regulatory agen2 cy; 

3 (B) identifying cybersecurity requirements 

4 that are overly burdensome, inconsistent, or 

5 contradictory, as determined by the Committee; 

6 and 

7 (C) developing recommendations for updat8 ing regulations, guidance, and examinations to 

9 address overly burdensome, inconsistent, or con10 tradictory cybersecurity requirements identified 

11 under subparagraph (B) to achieve harmoni12 zation. 

13 (3) PUBLICATION.—Upon completion of the 

14 regulatory framework, the Committee shall publish 

15 the regulatory framework in the Federal Register. 

16 (f) PILOT PROGRAM ON IMPLEMENTATION OF REGU17 LATORY FRAMEWORK.— 

18 (1) IN GENERAL.—Not fewer than 3 regulatory 

19 agencies, selected by the Committee, shall carry out 

20 a pilot program to implement the regulatory frame21 work with respect to not fewer than 3 cybersecurity 

22 requirements. 

23 (2) PARTICIPATION BY REGULATORY AGENCIES

24 AND REGULATED ENTITIES.— 


ssavage on LAPJG3WLY3PROD with BILLS
9 

•HR 10123 IH

1 (A) REGULATORY AGENCIES.—Participa2 tion in the pilot program by a regulatory agen3 cy shall be voluntary and subject to the consent 

4 of the regulatory agency following selection by 

5 the Committee under paragraph (1). 

6 (B) REGULATED ENTITIES.—Participation 

7 in the pilot program by a regulated entity shall 

8 be voluntary. 

9 (3) SELECTION OF CYBERSECURITY REQUIRE10 MENTS.—Cybersecurity requirements selected for the 

11 pilot program under paragraph (1) shall contain 

12 substantially similar or substantially related require13 ments such that not fewer than 2 of the selected cy14 bersecurity requirements govern the same regulated 

15 entity with substantially similar or substantially re16 lated requirements relating to information security 

17 or cybersecurity. 

18 (4) WAIVERS.— 

19 (A) IN GENERAL.—Notwithstanding any 

20 provision of subchapter II of chapter 5, and 

21 chapter 7, of title 5, United States Code (com22 monly known as the ‘‘Administrative Procedure 

23 Act’’) and subject to the consent of any partici24 pating regulated entity, in implementing the 

25 pilot program under paragraph (1), a reguVerDate Sep 11 2014 01:14 Nov 15, 2024 Jkt 059200 PO 00000 Frm 00009 Fmt 6652 Sfmt 6201 E:\BILLS\H10123.IH H10123

ssavage on LAPJG3WLY3PROD with BILLS
10 

•HR 10123 IH

1 latory agency participating in the pilot program 

2 shall have the authority, as the regulatory agen3 cy determines appropriate, to both issue waivers 

4 and establish alternative procedures for regu5 lated entities participating in the pilot program 

6 with respect to the cybersecurity requirements 

7 included under the pilot program. 

8 (B) COMPLIANCE.—A regulated entity that 

9 notifies a regulator of the entity’s participation 

10 in a pilot program shall be deemed in compli11 ance with the waived requirements to the extent 

12 that the entity complies with requirements of 

13 the pilot program. 

14 (5) SUBSEQUENT PILOT PROGRAM.—The Com15 mittee may only authorize an additional pilot pro16 gram after the later of— 

17 (A) the date of the conclusion of all 3 ini18 tial pilot programs under paragraph (1); and 

19 (B) the date of submission of all reports 

20 required under subsection (i) for each initial 

21 pilot program. 

22 (g) CONSULTATION WITH THE COMMITTEE.— 

23 (1) IN GENERAL.—Notwithstanding any other 

24 provision of law— 


ssavage on LAPJG3WLY3PROD with BILLS
11 

•HR 10123 IH

1 (A) except when an exigent circumstance 

2 described in paragraph (3) exists, before pre3 scribing any cybersecurity requirement, the 

4 head of a regulatory agency shall consult with 

5 the Committee regarding such requirement and 

6 the regulatory framework; and 

7 (B) independent regulatory agencies, when 

8 updating any existing cybersecurity requirement 

9 or issuing a potential new cybersecurity require10 ment, shall consult the Committee during the 

11 development of the updated cybersecurity re12 quirement or the new cybersecurity requirement 

13 to ensure that the requirement is aligned to the 

14 greatest extent possible with the regulatory 

15 framework. 

16 (2) CONSULTATION REPORT.—Following a con17 sultation under paragraph (1), the Committee, in co18 ordination with the Office of Management and 

19 Budget as necessary, shall provide to the agency a 

20 report that shall— 

21 (A) include to what degree the proposed 

22 cybersecurity requirement or update to the cy23 bersecurity requirement aligns with the regu24 latory framework, taking into consideration the 

25 authorities of the agency; and 


ssavage on LAPJG3WLY3PROD with BILLS
12 

•HR 10123 IH

1 (B) provide a list of recommendations to 

2 improve the cybersecurity requirement and to 

3 align the cybersecurity requirement with the 

4 regulatory framework. 

5 (3) EXIGENT CIRCUMSTANCES.—In the case of 

6 an exigent circumstance where an agency is author7 ized by law to act expeditiously, the agency shall no8 tify the Committee as soon as possible. 

9 (h) CONSULTATION WITH SECTOR RISK MANAGE10 MENT AGENCIES.—The Committee shall consult with ap11 propriate Sector Risk Management Agencies in the devel12 opment of the regulatory framework and the implementa13 tion of the pilot program under subsection (f) and shall 

14 consult with members of industry and critical infrastruc15 ture, as appropriate, for the development of the regulatory 

16 framework and pilot program. 

17 (i) REPORTS.— 

18 (1) ANNUAL REPORT.—Not later than 1 year 

19 after the date of enactment of this Act, and annually 

20 thereafter, the Committee shall submit to the appro21 priate congressional committees a report detailing— 

22 (A) member participation, including the ra23 tionale for any nonparticipation by Committee 

24 members; 


ssavage on LAPJG3WLY3PROD with BILLS
13 

•HR 10123 IH

1 (B) the application of the regulatory 

2 framework, once developed, on cybersecurity re3 quirements, including consultations or discus4 sions with regulators; and 

5 (C) any report made under subsection 

6 (g)(2). 

7 (2) PILOT PROGRAM REPORT.—Not later than 

8 1 year after the date on which a pilot program 

9 under subsection (f) begins, the Committee shall 

10 submit to the appropriate congressional committees 

11 a report detailing— 

12 (A) the cybersecurity requirements selected 

13 for the program, including— 

14 (i) the reasons that the regulatory 

15 agency and cybersecurity requirement were 

16 selected; 

17 (ii) a list of the pilot programs consid18 ered by the Committee; and 

19 (iii) the rationale for selecting the 

20 pilot program; 

21 (B) the information learned from the pro22 gram; 

23 (C) any obstacles encountered during the 

24 program; and 


ssavage on LAPJG3WLY3PROD with BILLS
14 

•HR 10123 IH

1 (D) an assessment of the applicability of 

2 expanding the program to other agencies and 

3 cybersecurity requirements. 

4 SEC. 4. STATUS UPDATES ON INCIDENT REPORTING. 

5 (a) STATUS UPDATE ON MEMORANDA OF AGREE6 MENT.—Not later than 180 days after the date of enact7 ment of this Act, and not less frequently than every 180 

8 days thereafter until the date that is 1 year after the date 

9 that the final rule required under section 2242 of the 

10 Homeland Security Act of 2002 (6 U.S.C. 681b) is pub11 lished in the Federal Register, the Director of the Cyber12 security and Infrastructure Security Agency shall provide 

13 to the appropriate congressional committees a status up14 date on the development and implementation of docu15 mented agreements between agencies required under sec16 tion 104(a)(5) of the Cyber Incident Reporting for Critical 

17 Infrastructure Act of 2022 (6 U.S.C. 681g(a)(5)). 

18 (b) YEARLY BRIEFING ON ACTIVITIES OF THE

19 CYBER INCIDENT REPORTING COUNCIL.—Section 2246 of 

20 the Homeland Security Act of 2002 (6 U.S.C. 681f) is 

21 amended— 

22 (1) by redesignating subsection (b) as sub23 section (c); and 

24 (2) by inserting after subsection (a) the fol25 lowing: 


ssavage on LAPJG3WLY3PROD with BILLS
15 

•HR 10123 IH

1 ‘‘(b) Not later than 1 year after the date of enact2 ment of the Streamlining Federal Cybersecurity Regula3 tions Act, and not less frequently than every 1 year there4 after until the date that is 7 years after the date of enact5 ment of such Act, the Secretary shall brief the Committee 

6 on Homeland Security and Governmental Affairs of the 

7 Senate and the Committee on Homeland Security of the 

8 House of Representatives on the activities of the Cyber 

9 Incident Reporting Council.’’. 

10 SEC. 5. RULE OF CONSTRUCTION. 

11 Nothing in this Act shall be construed— 

12 (1) to expand or alter the existing regulatory 

13 authorities of any agency, including any independent 

14 regulatory agency, except for exemptions under sec15 tion 3(f) to implement the pilot program established 

16 under that section; or 

17 (2) to provide any such agency any new or ad18 ditional regulatory authorities. 

Æ 


ssavage on LAPJG3WLY3PROD with BILLS