```

[Congressional Bills 118th Congress]
[From the U.S. Government Publishing Office]
[H.R. 10123 Introduced in House (IH)]

<DOC>

118th CONGRESS
  2d Session
                               H. R. 10123

 To establish an interagency committee to harmonize regulatory regimes 
in the United States relating to cybersecurity, and for other purposes.

_______________________________________________________________________

                    IN THE HOUSE OF REPRESENTATIVES

                           November 14, 2024

   Mr. Higgins of Louisiana introduced the following bill; which was 
   referred to the Committee on Oversight and Accountability, and in 
  addition to the Committee on Homeland Security, for a period to be 
subsequently determined by the Speaker, in each case for consideration 
  of such provisions as fall within the jurisdiction of the committee 
                               concerned

_______________________________________________________________________

                                 A BILL

 
 To establish an interagency committee to harmonize regulatory regimes 
in the United States relating to cybersecurity, and for other purposes.

    Be it enacted by the Senate and House of Representatives of the 
United States of America in Congress assembled,

SECTION 1. SHORT TITLE.

    This Act may be cited as the ``Streamlining Federal Cybersecurity 
Regulations Act''.

SEC. 2. DEFINITIONS.

    In this Act:
            (1) Agency.--The term ``agency'' has the meaning given that 
        term in section 551 of title 5, United States Code.
            (2) Appropriate congressional committees.--The term 
        ``appropriate congressional committees'' means--
                    (A) the Committee on Homeland Security and 
                Governmental Affairs of the Senate;
                    (B) the Committee on Oversight and Accountability 
                of the House of Representatives;
                    (C) each committee of Congress with jurisdiction 
                over the activities of a regulatory agency; and
                    (D) each committee of Congress with jurisdiction 
                over the activities of a Sector Risk Management Agency 
                with respect to a sector regulated by a regulatory 
                agency.
            (3) Committee.--The term ``Committee'' means the 
        Harmonization Committee established under section 3(a).
            (4) Cybersecurity requirement.--The term ``cybersecurity 
        requirement'' means an administrative, technical, or physical 
        safeguard, requirement, or supervisory activity, including 
        regulations, guidance, bulletins, or examinations, relating to 
        information security, security of information technology or 
        operational technology, cybersecurity, or cyber risk or 
        resilience.
            (5) Harmonization.--
                    (A) Definition.--The term ``harmonization'' means 
                the process of aligning cybersecurity requirements 
                issued by regulatory agencies such that the 
                requirements consist of--
                            (i) a common set of minimum requirements 
                        that may apply across sectors and that can be 
                        updated periodically to address new or evolving 
                        risks relating to information security or 
                        cybersecurity; and
                            (ii) sector-specific requirements, which 
                        may include performance-based requirements, 
                        that--
                                    (I) are necessary to address 
                                sector-specific risks that are not 
                                adequately addressed by the minimum 
                                requirements described in clause (i); 
                                and
                                    (II) are substantially similar, 
                                where appropriate, to other 
                                requirements in that sector or a 
                                similar sector.
                    (B) Rule of construction.--Nothing in this 
                definition shall be construed to exempt regulatory 
                agencies from any otherwise applicable processes or 
                laws relating to updating regulations, including 
                subchapter II of chapter 5, and chapter 7, of title 5, 
                United States Code (commonly known as the 
                ``Administrative Procedure Act'').
            (6) Independent regulatory agency.--The term ``independent 
        regulatory agency'' has the meaning given that term in section 
        3502 of title 44, United States Code.
            (7) Reciprocity.--The term ``reciprocity'' means the 
        recognition or acceptance by 1 regulatory agency of an 
        assessment, determination, examination, finding, or conclusion 
        of another regulatory agency for determining that a regulated 
        entity has complied with a cybersecurity requirement.
            (8) Regulatory agency.--The term ``regulatory agency'' 
        means--
                    (A) any independent regulatory agency that has the 
                statutory authority to issue or enforce any mandatory 
                cybersecurity requirement; or
                    (B) any other agency that has the statutory 
                authority to issue or enforce any cybersecurity 
                requirement.
            (9) Regulatory framework.--The term ``regulatory 
        framework'' means the framework developed under section 
        3(e)(1).
            (10) Sector risk management agency.--The term ``Sector Risk 
        Management Agency'' has the meaning given that term in section 
        2200 of the Homeland Security Act of 2002 (6 U.S.C. 650).

SEC. 3. ESTABLISHMENT OF INTERAGENCY COMMITTEE TO HARMONIZE REGULATORY 
              REGIMES IN THE UNITED STATES RELATING TO CYBERSECURITY.

    (a) Harmonization Committee.--
            (1) In general.--The National Cyber Director shall 
        establish an interagency committee to be known as the 
        Harmonization Committee to enhance the harmonization of 
        cybersecurity requirements that are applicable within the 
        United States.
            (2) Support.--The National Cyber Director shall provide the 
        Committee with administrative and management support as 
        appropriate.
    (b) Members.--
            (1) In general.--The Committee shall be composed of--
                    (A) the National Cyber Director;
                    (B) the head of each regulatory agency;
                    (C) the head of the Office of Information and 
                Regulatory Affairs of the Office of Management and 
                Budget; and
                    (D) the head of other appropriate agencies, as 
                determined by the chair of the Committee.
            (2) Publication of list of members.--The Committee shall 
        maintain, on a publicly available website, a list of the 
        agencies that are represented on the Committee, and shall 
        update the list as members are added or removed.
    (c) Chair.--The National Cyber Director shall be the chair of the 
Committee.
    (d) Charter.--The Committee shall develop, deliver to Congress, and 
make publicly available a charter, which shall--
            (1) include the processes and rules of the Committee; and
            (2) detail--
                    (A) the objective and scope of the Committee; and
                    (B) other items as necessary.
    (e) Regulatory Framework for Harmonization.--
            (1) In general.--
                    (A) Framework.--
                            (i) In general.--Not later than 1 year 
                        after the date of enactment of this Act, the 
                        Committee shall develop a regulatory framework 
                        for achieving harmonization of the 
                        cybersecurity requirements of each regulatory 
                        agency.
                            (ii) Development.--The process for 
                        developing such regulatory framework shall 
                        include the opportunity for public comment and 
                        consultation with industry experts and other 
                        stakeholders.
                    (B) Factors.--In developing the framework under 
                subparagraph (A), the Committee shall account for 
                existing sector-specific cybersecurity requirements 
                that are identified as unique or critical to a sector.
            (2) Minimum requirements.--The framework shall contain, at 
        a minimum, processes for--
                    (A) establishing a reciprocal compliance mechanism 
                for minimum requirements relating to information 
                security or cybersecurity for entities regulated by 
                more than 1 regulatory agency;
                    (B) identifying cybersecurity requirements that are 
                overly burdensome, inconsistent, or contradictory, as 
                determined by the Committee; and
                    (C) developing recommendations for updating 
                regulations, guidance, and examinations to address 
                overly burdensome, inconsistent, or contradictory 
                cybersecurity requirements identified under 
                subparagraph (B) to achieve harmonization.
            (3) Publication.--Upon completion of the regulatory 
        framework, the Committee shall publish the regulatory framework 
        in the Federal Register.
    (f) Pilot Program on Implementation of Regulatory Framework.--
            (1) In general.--Not fewer than 3 regulatory agencies, 
        selected by the Committee, shall carry out a pilot program to 
        implement the regulatory framework with respect to not fewer 
        than 3 cybersecurity requirements.
            (2) Participation by regulatory agencies and regulated 
        entities.--
                    (A) Regulatory agencies.--Participation in the 
                pilot program by a regulatory agency shall be voluntary 
                and subject to the consent of the regulatory agency 
                following selection by the Committee under paragraph 
                (1).
                    (B) Regulated entities.--Participation in the pilot 
                program by a regulated entity shall be voluntary.
            (3) Selection of cybersecurity requirements.--Cybersecurity 
        requirements selected for the pilot program under paragraph (1) 
        shall contain substantially similar or substantially related 
        requirements such that not fewer than 2 of the selected 
        cybersecurity requirements govern the same regulated entity 
        with substantially similar or substantially related 
        requirements relating to information security or cybersecurity.
            (4) Waivers.--
                    (A) In general.--Notwithstanding any provision of 
                subchapter II of chapter 5, and chapter 7, of title 5, 
                United States Code (commonly known as the 
                ``Administrative Procedure Act'') and subject to the 
                consent of any participating regulated entity, in 
                implementing the pilot program under paragraph (1), a 
                regulatory agency participating in the pilot program 
                shall have the authority, as the regulatory agency 
                determines appropriate, to both issue waivers and 
                establish alternative procedures for regulated entities 
                participating in the pilot program with respect to the 
                cybersecurity requirements included under the pilot 
                program.
                    (B) Compliance.--A regulated entity that notifies a 
                regulator of the entity's participation in a pilot 
                program shall be deemed in compliance with the waived 
                requirements to the extent that the entity complies 
                with requirements of the pilot program.
            (5) Subsequent pilot program.--The Committee may only 
        authorize an additional pilot program after the later of--
                    (A) the date of the conclusion of all 3 initial 
                pilot programs under paragraph (1); and
                    (B) the date of submission of all reports required 
                under subsection (i) for each initial pilot program.
    (g) Consultation With the Committee.--
            (1) In general.--Notwithstanding any other provision of 
        law--
                    (A) except when an exigent circumstance described 
                in paragraph (3) exists, before prescribing any 
                cybersecurity requirement, the head of a regulatory 
                agency shall consult with the Committee regarding such 
                requirement and the regulatory framework; and
                    (B) independent regulatory agencies, when updating 
                any existing cybersecurity requirement or issuing a 
                potential new cybersecurity requirement, shall consult 
                the Committee during the development of the updated 
                cybersecurity requirement or the new cybersecurity 
                requirement to ensure that the requirement is aligned 
                to the greatest extent possible with the regulatory 
                framework.
            (2) Consultation report.--Following a consultation under 
        paragraph (1), the Committee, in coordination with the Office 
        of Management and Budget as necessary, shall provide to the 
        agency a report that shall--
                    (A) include to what degree the proposed 
                cybersecurity requirement or update to the 
                cybersecurity requirement aligns with the regulatory 
                framework, taking into consideration the authorities of 
                the agency; and
                    (B) provide a list of recommendations to improve 
                the cybersecurity requirement and to align the 
                cybersecurity requirement with the regulatory 
                framework.
            (3) Exigent circumstances.--In the case of an exigent 
        circumstance where an agency is authorized by law to act 
        expeditiously, the agency shall notify the Committee as soon as 
        possible.
    (h) Consultation With Sector Risk Management Agencies.--The 
Committee shall consult with appropriate Sector Risk Management 
Agencies in the development of the regulatory framework and the 
implementation of the pilot program under subsection (f) and shall 
consult with members of industry and critical infrastructure, as 
appropriate, for the development of the regulatory framework and pilot 
program.
    (i) Reports.--
            (1) Annual report.--Not later than 1 year after the date of 
        enactment of this Act, and annually thereafter, the Committee 
        shall submit to the appropriate congressional committees a 
        report detailing--
                    (A) member participation, including the rationale 
                for any nonparticipation by Committee members;
                    (B) the application of the regulatory framework, 
                once developed, on cybersecurity requirements, 
                including consultations or discussions with regulators; 
                and
                    (C) any report made under subsection (g)(2).
            (2) Pilot program report.--Not later than 1 year after the 
        date on which a pilot program under subsection (f) begins, the 
        Committee shall submit to the appropriate congressional 
        committees a report detailing--
                    (A) the cybersecurity requirements selected for the 
                program, including--
                            (i) the reasons that the regulatory agency 
                        and cybersecurity requirement were selected;
                            (ii) a list of the pilot programs 
                        considered by the Committee; and
                            (iii) the rationale for selecting the pilot 
                        program;
                    (B) the information learned from the program;
                    (C) any obstacles encountered during the program; 
                and
                    (D) an assessment of the applicability of expanding 
                the program to other agencies and cybersecurity 
                requirements.

SEC. 4. STATUS UPDATES ON INCIDENT REPORTING.

    (a) Status Update on Memoranda of Agreement.--Not later than 180 
days after the date of enactment of this Act, and not less frequently 
than every 180 days thereafter until the date that is 1 year after the 
date that the final rule required under section 2242 of the Homeland 
Security Act of 2002 (6 U.S.C. 681b) is published in the Federal 
Register, the Director of the Cybersecurity and Infrastructure Security 
Agency shall provide to the appropriate congressional committees a 
status update on the development and implementation of documented 
agreements between agencies required under section 104(a)(5) of the 
Cyber Incident Reporting for Critical Infrastructure Act of 2022 (6 
U.S.C. 681g(a)(5)).
    (b) Yearly Briefing on Activities of the Cyber Incident Reporting 
Council.--Section 2246 of the Homeland Security Act of 2002 (6 U.S.C. 
681f) is amended--
            (1) by redesignating subsection (b) as subsection (c); and
            (2) by inserting after subsection (a) the following:
    ``(b) Not later than 1 year after the date of enactment of the 
Streamlining Federal Cybersecurity Regulations Act, and not less 
frequently than every 1 year thereafter until the date that is 7 years 
after the date of enactment of such Act, the Secretary shall brief the 
Committee on Homeland Security and Governmental Affairs of the Senate 
and the Committee on Homeland Security of the House of Representatives 
on the activities of the Cyber Incident Reporting Council.''.

SEC. 5. RULE OF CONSTRUCTION.

    Nothing in this Act shall be construed--
            (1) to expand or alter the existing regulatory authorities 
        of any agency, including any independent regulatory agency, 
        except for exemptions under section 3(f) to implement the pilot 
        program established under that section; or
            (2) to provide any such agency any new or additional 
        regulatory authorities.
                                 <all>
```