II 

Calendar No. 655 

118TH CONGRESS 

2D SESSION S. 4630 

[Report No. 118–254] 

To establish an interagency committee to harmonize regulatory regimes in 

the United States relating to cybersecurity, and for other purposes. 

IN THE SENATE OF THE UNITED STATES 

JULY 8, 2024 

Mr. PETERS (for himself, Mr. LANKFORD, Ms. ROSEN, and Mr. KING) introduced the following bill; which was read twice and referred to the Committee on Homeland Security and Governmental Affairs 

DECEMBER 2, 2024 

Reported by Mr. PETERS, with an amendment 

[Strike out all after the enacting clause and insert the part printed in italic] 

A BILL 

To establish an interagency committee to harmonize regulatory regimes in the United States relating to cybersecurity, and for other purposes. 

1 Be it enacted by the Senate and House of Representa2 tives of the United States of America in Congress assembled, 

3 SECTION 1. SHORT TITLE. 

4 This Act may be cited as the ‘‘Streamlining Federal 

5 Cybersecurity Regulations Act’’. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
2 

•S 4630 RS

1 SEC. 2. DEFINITIONS. 

2 In this Act: 

3 (1) AGENCY.—The term ‘‘agency’’ has the 

4 meaning given that term in section 551 of title 5, 

5 United States Code. 

6 (2) APPROPRIATE CONGRESSIONAL COMMIT7 TEES.—The term ‘‘appropriate congressional com8 mittees’’ means— 

9 (A) the Committee on Homeland Security 

10 and Governmental Affairs of the Senate; 

11 (B) the Committee on Oversight and Ac12 countability of the House of Representatives; 

13 (C) each committee of Congress with juris14 diction over the activities of a regulatory agen15 cy; and 

16 (D) each committee of Congress with juris17 diction over the activities of a Sector Risk Man18 agement Agency with respect to a sector regu19 lated by a regulatory agency. 

20 (3) COMMITTEE.—The term ‘‘Committee’’ 

21 means the Harmonization Committee established 

22 under section 3(a). 

23 (4) CYBERSECURITY REQUIREMENT.—The term 

24 ‘‘cybersecurity requirement’’ means an administra25 tive, technical, or physical safeguard, requirement, 

26 or supervisory activity, including regulations, guidVerDate Sep 11 2014 05:49 Dec 03, 2024 Jkt 059200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6401 E:\BILLS\S4630.RS S4630

kjohnson on DSK7ZCZBW3PROD with $$_JOB
3 

•S 4630 RS

1 ance, bulletins or examinations, relating to informa2 tion security, information technology, cybersecurity, 

3 or cyber risk or resilience. 

4 (5) HARMONIZATION.— 

5 (A) DEFINITION.—The term ‘‘harmoni6 zation’’ means the process of aligning cyberse7 curity requirements issued by regulatory agen8 cies such that the requirements consist of— 

9 (i) a common set of minimum require10 ments that apply across sectors and that 

11 can be updated periodically to address new 

12 or evolving risks relating to information se13 curity or cybersecurity; and 

14 (ii) sector-specific requirements 

15 that— 

16 (I) are necessary to address sec17 tor-specific risks that are not ade18 quately addressed by the minimum re19 quirements in clause (i); and 

20 (II) are substantially similar, 

21 where appropriate, to other require22 ments in that sector or a similar sec23 tor. 

24 (B) RULE OF CONSTRUCTION.—Nothing in 

25 this definition shall be construed to exempt regVerDate Sep 11 2014 05:49 Dec 03, 2024 Jkt 059200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6401 E:\BILLS\S4630.RS S4630

kjohnson on DSK7ZCZBW3PROD with $$_JOB
4 

•S 4630 RS

1 ulatory agencies from any otherwise applicable 

2 processes or laws relating to updating regula3 tions, including subchapter II of chapter 5, and 

4 chapter 7, of title 5, United States Code (com5 monly known as the ‘‘Administrative Procedure 

6 Act’’). 

7 (6) INDEPENDENT REGULATORY AGENCY.—The 

8 term ‘‘independent regulatory agency’’ has the 

9 meaning given that term in section 3502 of title 44, 

10 United States Code. 

11 (7) RECIPROCITY.—The term ‘‘reciprocity’’ 

12 means the recognition or acceptance by 1 regulatory 

13 agency of an assessment, determination, examina14 tion, finding, or conclusion of another regulatory 

15 agency for determining that a regulated entity has 

16 complied with a cybersecurity requirement. 

17 (8) REGULATORY AGENCY.—The term ‘‘regu18 latory agency’’ means— 

19 (A) any independent regulatory agency 

20 that has the statutory authority to issue or en21 force any mandatory cybersecurity requirement; 

22 or 

23 (B) any other agency that has the statu24 tory authority to issue or enforce any cyberse25 curity requirement. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
5 

•S 4630 RS

1 (9) REGULATORY FRAMEWORK.—The term 

2 ‘‘regulatory framework’’ means the framework devel3 oped under section 3(e)(1). 

4 (10) SECTOR RISK MANAGEMENT AGENCY.— 

5 The term ‘‘Sector Risk Management Agency’’ has 

6 the meaning given that term in section 2200 of the 

7 Homeland Security Act of 2002 (6 U.S.C. 650). 

8 SEC. 3. ESTABLISHMENT OF INTERAGENCY COMMITTEE TO 

9 HARMONIZE REGULATORY REGIMES IN THE 

10 UNITED STATES RELATING TO CYBERSECU11 RITY. 

12 (a) HARMONIZATION COMMITTEE.— 

13 (1) IN GENERAL.—The National Cyber Director 

14 shall establish an interagency committee to be 

15 known as the Harmonization Committee to enhance 

16 the harmonization of cybersecurity requirements 

17 that are applicable within the United States. 

18 (2) SUPPORT.—The National Cyber Director 

19 shall provide the Committee with administrative and 

20 management support as appropriate. 

21 (b) MEMBERS.— 

22 (1) IN GENERAL.—The Committee shall be 

23 composed of— 

24 (A) the National Cyber Director; 

25 (B) the head of each regulatory agency; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
6 

•S 4630 RS

1 (C) the head of the Office of Information 

2 and Regulatory Affairs of the Office of Manage3 ment and Budget; and 

4 (D) the head of other appropriate agencies, 

5 as determined by the chair of the Committee. 

6 (2) PUBLICATION OF LIST OF MEMBERS.—The 

7 Committee shall maintain a list of the agencies that 

8 are represented on the Committee on a publicly 

9 available website. 

10 (c) CHAIR.—The National Cyber Director shall be 

11 the chair of the Committee. 

12 (d) CHARTER.—The Committee shall develop, deliver 

13 to Congress, and make publicly available a charter, which 

14 shall— 

15 (1) include the processes and rules of the Com16 mittee; and 

17 (2) detail— 

18 (A) the objective and scope of the Com19 mittee; and 

20 (B) other items as necessary. 

21 (e) REGULATORY FRAMEWORK FOR HARMONI22 ZATION.— 

23 (1) IN GENERAL.— 

24 (A) FRAMEWORK.—Not later than 1 year 

25 after the date of enactment of this Act, the 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
7 

•S 4630 RS

1 Committee shall develop a regulatory frame2 work for achieving harmonization of the cyber3 security requirements of each regulatory agen4 cy. 

5 (B) FACTORS.—In developing the frame6 work under subparagraph (A), the Committee 

7 shall account for existing sector-specific cyber8 security requirements that are identified as 

9 unique or critical to a sector. 

10 (2) MINIMUM REQUIREMENTS.—The framework 

11 shall contain, at a minimum, processes for— 

12 (A) establishing a reciprocal compliance 

13 mechanism for minimum requirements relating 

14 to information security or cybersecurity for en15 tities regulated by more than 1 regulatory agen16 cy; 

17 (B) identifying cybersecurity requirements 

18 that are overly burdensome, inconsistent, or 

19 contradictory, as determined by the Committee; 

20 and 

21 (C) developing recommendations for updat22 ing regulations, guidance, and examinations to 

23 address overly burdensome, inconsistent, or con24 tradictory cybersecurity requirements identified 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
8 

•S 4630 RS

1 under subparagraph (B) to achieve harmoni2 zation. 

3 (3) PUBLICATION.—Upon completion of the 

4 regulatory framework, the Committee shall publish 

5 the regulatory framework in the Federal Register. 

6 (f) PILOT PROGRAM ON IMPLEMENTATION OF REGU7 LATORY FRAMEWORK.— 

8 (1) IN GENERAL.—Not fewer than 3 regulatory 

9 agencies, selected by the Committee, shall carry out 

10 a pilot program to implement the regulatory frame11 work established under subsection (e) with respect to 

12 not fewer than 3 cybersecurity requirements. 

13 (2) PARTICIPATION BY REGULATORY AGENCIES

14 AND REGULATED ENTITIES.— 

15 (A) REGULATORY AGENCIES.—Participa16 tion in the pilot program by a regulatory agen17 cy shall be voluntary and subject to the consent 

18 of the regulatory agency following selection by 

19 the Committee under paragraph (1). 

20 (B) REGULATED ENTITIES.—Participation 

21 in the pilot program by a regulated entity shall 

22 be voluntary. 

23 (3) SELECTION OF CYBERSECURITY REQUIRE24 MENTS.—Cybersecurity requirements selected for the 

25 pilot program under paragraph (1) shall contain 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
9 

•S 4630 RS

1 substantially similar or substantially related require2 ments such that not fewer than 2 of the selected cy3 bersecurity requirements govern the same regulated 

4 entity with substantially similar or substantially re5 lated requirements relating to information security 

6 or cybersecurity. 

7 (4) WAIVERS.—Notwithstanding any provision 

8 of subchapter II of chapter 5, and chapter 7, of title 

9 5, United States Code (commonly known as the 

10 ‘‘Administrative Procedure Act’’) and subject to the 

11 consent of any participating regulated entity, in im12 plementing the pilot program under paragraph (1), 

13 a regulatory agency participating in the pilot pro14 gram shall have the authority to issue waivers and 

15 establish alternative procedures for regulated entities 

16 participating in the pilot program with respect to 

17 the cybersecurity requirements included under the 

18 pilot program. 

19 (g) CONSULTATION WITH THE COMMITTEE.— 

20 (1) IN GENERAL.—Notwithstanding any other 

21 provision of law— 

22 (A) before prescribing any cybersecurity 

23 requirement, the head of a regulatory agency 

24 shall consult with the Committee regarding 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
10 

•S 4630 RS

1 such requirement and the regulatory framework 

2 established under subsection (e); and 

3 (B) independent regulatory agencies, when 

4 updating any existing cybersecurity requirement 

5 or issuing a potential new cybersecurity require6 ment, shall consult the Committee during the 

7 development of the updated cybersecurity re8 quirement or the new cybersecurity requirement 

9 to ensure that the requirement is aligned to the 

10 greatest extent possible with the regulatory 

11 framework. 

12 (2) DETERMINATION.—Following a consultation 

13 under paragraph (1), the Committee shall make a 

14 determination in writing to the agency, in coordina15 tion with the Office of Management and Budget as 

16 necessary, that shall— 

17 (A) include to what degree the proposed 

18 cybersecurity requirement or update to the cy19 bersecurity requirement aligns with the regu20 latory framework; and 

21 (B) provide a list of recommendations to 

22 improve the cybersecurity requirement and 

23 align it with the regulatory framework. 

24 (h) CONSULTATION WITH SECTOR RISK MANAGE25 MENT AGENCIES.—The Committee shall consult with apVerDate Sep 11 2014 05:49 Dec 03, 2024 Jkt 059200 PO 00000 Frm 00010 Fmt 6652 Sfmt 6401 E:\BILLS\S4630.RS S4630

kjohnson on DSK7ZCZBW3PROD with $$_JOB
11 

•S 4630 RS

1 propriate Sector Risk Management Agencies in the devel2 opment of the regulatory framework under subsection (e) 

3 and the implementation of the pilot program under sub4 section (f). 

5 (i) REPORTS.— 

6 (1) ANNUAL REPORT.—Not later than 12 

7 months after the date of enactment of this Act, and 

8 annually thereafter, the Committee shall submit to 

9 the appropriate congressional committees a report 

10 detailing— 

11 (A) member participation; and 

12 (B) the application of the regulatory 

13 framework, once developed, on cybersecurity re14 quirements, including consultations or discus15 sions with regulators. 

16 (2) PILOT PROGRAM REPORT.—Not later than 

17 12 months after the date on which the pilot program 

18 begins, the Committee shall submit to the appro19 priate congressional committees a report detailing— 

20 (A) the cybersecurity requirements selected 

21 for the program, including the reasons that the 

22 regulatory agency and cybersecurity require23 ment were selected; 

24 (B) the information learned from the pro25 gram; 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
12 

•S 4630 RS

1 (C) any obstacles encountered during the 

2 program; and 

3 (D) an assessment of the applicability of 

4 expanding the program to other agencies and 

5 cybersecurity requirements. 

6 SEC. 4. STATUS UPDATES ON INCIDENT REPORTING. 

7 (a) STATUS UPDATE ON MEMORANDA OF AGREE8 MENT.—Not later than 180 days after the date of enact9 ment of this Act, and not less frequently than every 180 

10 days thereafter, the Director of the Cybersecurity and In11 frastructure Security Agency shall provide to the appro12 priate congressional committees a status update on the de13 velopment and implementation of memoranda of agree14 ment between agencies required under section 104(a)(5) 

15 of the Cyber Incident Reporting for Critical Infrastructure 

16 Act of 2022 (6 U.S.C. 681g(a)(5)). 

17 (b) STATUS UPDATE ON EFFORTS OF THE CYBER

18 INCIDENT REPORTING COUNCIL.—Not later than 180 

19 days after the date of enactment of this Act, and not less 

20 frequently than every 180 days thereafter, the Secretary 

21 of Homeland Security shall provide to the appropriate con22 gressional committees a status update on the efforts of 

23 the Cyber Incident Reporting Council established under 

24 section 2246 of the Homeland Security Act of 2002 (6 

25 U.S.C. 681f). 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
13 

•S 4630 RS

1 SEC. 5. RULE OF CONSTRUCTION. 

2 Nothing in this Act shall be construed— 

3 (1) to expand or alter the existing regulatory 

4 authorities of any agency, including any independent 

5 regulatory agency, except for exemptions under sec6 tion 3(f) to implement the pilot program established 

7 under that section; 

8 (2) to provide any such agency any new or ad9 ditional regulatory authorities; or 

10 (3) to address security incident reporting re11 quirements subject to coordination by the Cyber In12 cident Reporting Council established under section 

13 2246 of the Homeland Security Act of 2022 (6 

14 U.S.C. 681f), except for the required status updates 

15 under section 4. 

16 SECTION 1. SHORT TITLE. 

17 This Act may be cited as the ‘‘Streamlining Federal 

18 Cybersecurity Regulations Act’’. 

19 SEC. 2. DEFINITIONS. 

20 In this Act: 

21 (1) AGENCY.—The term ‘‘agency’’ has the mean22 ing given that term in section 551 of title 5, United 

23 States Code. 

24 (2) APPROPRIATE CONGRESSIONAL COMMIT25 TEES.—The term ‘‘appropriate congressional commit26 tees’’ means— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
14 

•S 4630 RS

1 (A) the Committee on Homeland Security 

2 and Governmental Affairs of the Senate; 

3 (B) the Committee on Oversight and Ac4 countability of the House of Representatives; 

5 (C) each committee of Congress with juris6 diction over the activities of a regulatory agency; 

7 and 

8 (D) each committee of Congress with juris9 diction over the activities of a Sector Risk Man10 agement Agency with respect to a sector regu11 lated by a regulatory agency. 

12 (3) COMMITTEE.—The term ‘‘Committee’’ means 

13 the Harmonization Committee established under sec14 tion 3(a). 

15 (4) CYBERSECURITY REQUIREMENT.—The term 

16 ‘‘cybersecurity requirement’’ means an administra17 tive, technical, or physical safeguard, requirement, or 

18 supervisory activity, including regulations, guidance, 

19 bulletins, or examinations, relating to information se20 curity, information technology, cybersecurity, or cyber 

21 risk or resilience. 

22 (5) HARMONIZATION.— 

23 (A) DEFINITION.—The term ‘‘harmoni24 zation’’ means the process of aligning cybersecuVerDate Sep 11 2014 05:49 Dec 03, 2024 Jkt 059200 PO 00000 Frm 00014 Fmt 6652 Sfmt 6203 E:\BILLS\S4630.RS S4630

kjohnson on DSK7ZCZBW3PROD with $$_JOB
15 

•S 4630 RS

1 rity requirements issued by regulatory agencies 

2 such that the requirements consist of— 

3 (i) a common set of minimum require4 ments that apply across sectors and that 

5 can be updated periodically to address new 

6 or evolving risks relating to information se7 curity or cybersecurity; and 

8 (ii) sector-specific requirements, which 

9 may include performance-based require10 ments, that— 

11 (I) are necessary to address sector12 specific risks that are not adequately 

13 addressed by the minimum require14 ments described in clause (i); and 

15 (II) are substantially similar, 

16 where appropriate, to other require17 ments in that sector or a similar sec18 tor. 

19 (B) RULE OF CONSTRUCTION.—Nothing in 

20 this definition shall be construed to exempt regu21 latory agencies from any otherwise applicable 

22 processes or laws relating to updating regula23 tions, including subchapter II of chapter 5, and 

24 chapter 7, of title 5, United States Code (comVerDate Sep 11 2014 05:49 Dec 03, 2024 Jkt 059200 PO 00000 Frm 00015 Fmt 6652 Sfmt 6203 E:\BILLS\S4630.RS S4630

kjohnson on DSK7ZCZBW3PROD with $$_JOB
16 

•S 4630 RS

1 monly known as the ‘‘Administrative Procedure 

2 Act’’). 

3 (6) INDEPENDENT REGULATORY AGENCY.—The 

4 term ‘‘independent regulatory agency’’ has the mean5 ing given that term in section 3502 of title 44, United 

6 States Code. 

7 (7) RECIPROCITY.—The term ‘‘reciprocity’’ 

8 means the recognition or acceptance by 1 regulatory 

9 agency of an assessment, determination, examination, 

10 finding, or conclusion of another regulatory agency 

11 for determining that a regulated entity has complied 

12 with a cybersecurity requirement. 

13 (8) REGULATORY AGENCY.—The term ‘‘regu14 latory agency’’ means— 

15 (A) any independent regulatory agency that 

16 has the statutory authority to issue or enforce 

17 any mandatory cybersecurity requirement; or 

18 (B) any other agency that has the statutory 

19 authority to issue or enforce any cybersecurity 

20 requirement. 

21 (9) REGULATORY FRAMEWORK.—The term ‘‘reg22 ulatory framework’’ means the framework developed 

23 under section 3(e)(1). 

24 (10) SECTOR RISK MANAGEMENT AGENCY.—The 

25 term ‘‘Sector Risk Management Agency’’ has the 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
17 

•S 4630 RS

1 meaning given that term in section 2200 of the 

2 Homeland Security Act of 2002 (6 U.S.C. 650). 

3 SEC. 3. ESTABLISHMENT OF INTERAGENCY COMMITTEE TO 

4 HARMONIZE REGULATORY REGIMES IN THE 

5 UNITED STATES RELATING TO CYBERSECU6 RITY. 

7 (a) HARMONIZATION COMMITTEE.— 

8 (1) IN GENERAL.—The National Cyber Director 

9 shall establish an interagency committee to be known 

10 as the Harmonization Committee to enhance the har11 monization of cybersecurity requirements that are ap12 plicable within the United States. 

13 (2) SUPPORT.—The National Cyber Director 

14 shall provide the Committee with administrative and 

15 management support as appropriate. 

16 (b) MEMBERS.— 

17 (1) IN GENERAL.—The Committee shall be com18 posed of— 

19 (A) the National Cyber Director; 

20 (B) the head of each regulatory agency; 

21 (C) the head of the Office of Information 

22 and Regulatory Affairs of the Office of Manage23 ment and Budget; and 

24 (D) the head of other appropriate agencies, 

25 as determined by the chair of the Committee. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
18 

•S 4630 RS

1 (2) PUBLICATION OF LIST OF MEMBERS.—The 

2 Committee shall maintain, on a publicly available 

3 website, a list of the agencies that are represented on 

4 the Committee, and shall update the list as members 

5 are added or removed. 

6 (c) CHAIR.—The National Cyber Director shall be the 

7 chair of the Committee. 

8 (d) CHARTER.—The Committee shall develop, deliver 

9 to Congress, and make publicly available a charter, which 

10 shall— 

11 (1) include the processes and rules of the Com12 mittee; and 

13 (2) detail— 

14 (A) the objective and scope of the Com15 mittee; and 

16 (B) other items as necessary. 

17 (e) REGULATORY FRAMEWORK FOR HARMONI18 ZATION.— 

19 (1) IN GENERAL.— 

20 (A) FRAMEWORK.—Not later than 1 year 

21 after the date of enactment of this Act, the Com22 mittee shall develop a regulatory framework for 

23 achieving harmonization of the cybersecurity re24 quirements of each regulatory agency. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
19 

•S 4630 RS

1 (B) FACTORS.—In developing the frame2 work under subparagraph (A), the Committee 

3 shall account for existing sector-specific cyberse4 curity requirements that are identified as unique 

5 or critical to a sector. 

6 (2) MINIMUM REQUIREMENTS.—The framework 

7 shall contain, at a minimum, processes for— 

8 (A) establishing a reciprocal compliance 

9 mechanism for minimum requirements relating 

10 to information security or cybersecurity for enti11 ties regulated by more than 1 regulatory agency; 

12 (B) identifying cybersecurity requirements 

13 that are overly burdensome, inconsistent, or con14 tradictory, as determined by the Committee; and 

15 (C) developing recommendations for updat16 ing regulations, guidance, and examinations to 

17 address overly burdensome, inconsistent, or con18 tradictory cybersecurity requirements identified 

19 under subparagraph (B) to achieve harmoni20 zation. 

21 (3) PUBLICATION.—Upon completion of the regu22 latory framework, the Committee shall publish the 

23 regulatory framework in the Federal Register for pub24 lic comment. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
20 

•S 4630 RS

1 (f) PILOT PROGRAM ON IMPLEMENTATION OF REGU2 LATORY FRAMEWORK.— 

3 (1) IN GENERAL.—Not fewer than 3 regulatory 

4 agencies, selected by the Committee, shall carry out a 

5 pilot program to implement the regulatory framework 

6 with respect to not fewer than 3 cybersecurity require7 ments. 

8 (2) PARTICIPATION BY REGULATORY AGENCIES

9 AND REGULATED ENTITIES.— 

10 (A) REGULATORY AGENCIES.—Participa11 tion in the pilot program by a regulatory agency 

12 shall be voluntary and subject to the consent of 

13 the regulatory agency following selection by the 

14 Committee under paragraph (1). 

15 (B) REGULATED ENTITIES.—Participation 

16 in the pilot program by a regulated entity shall 

17 be voluntary. 

18 (3) SELECTION OF CYBERSECURITY REQUIRE19 MENTS.—Cybersecurity requirements selected for the 

20 pilot program under paragraph (1) shall contain sub21 stantially similar or substantially related require22 ments such that not fewer than 2 of the selected cyber23 security requirements govern the same regulated enti24 ty with substantially similar or substantially related 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
21 

•S 4630 RS

1 requirements relating to information security or cy2 bersecurity. 

3 (4) WAIVERS.—Notwithstanding any provision 

4 of subchapter II of chapter 5, and chapter 7, of title 

5 5, United States Code (commonly known as the ‘‘Ad6 ministrative Procedure Act’’) and subject to the con7 sent of any participating regulated entity, in imple8 menting the pilot program under paragraph (1), a 

9 regulatory agency participating in the pilot program 

10 shall have the authority to issue waivers and establish 

11 alternative procedures for regulated entities partici12 pating in the pilot program with respect to the cyber13 security requirements included under the pilot pro14 gram. 

15 (5) SUBSEQUENT PILOT PROGRAM.—The Com16 mittee may only authorize an additional pilot pro17 gram after the later of— 

18 (A) the date of the conclusion of all 3 initial 

19 pilot programs under paragraph (1); and 

20 (B) the date of submission of all reports re21 quired under subsection (i) for each initial pilot 

22 program. 

23 (g) CONSULTATION WITH THE COMMITTEE.— 

24 (1) IN GENERAL.—Notwithstanding any other 

25 provision of law— 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
22 

•S 4630 RS

1 (A) except when an exigent circumstance 

2 described in paragraph (3) exists, before pre3 scribing any cybersecurity requirement, the head 

4 of a regulatory agency shall consult with the 

5 Committee regarding such requirement and the 

6 regulatory framework; and 

7 (B) independent regulatory agencies, when 

8 updating any existing cybersecurity requirement 

9 or issuing a potential new cybersecurity require10 ment, shall consult the Committee during the de11 velopment of the updated cybersecurity require12 ment or the new cybersecurity requirement to en13 sure that the requirement is aligned to the great14 est extent possible with the regulatory framework. 

15 (2) DETERMINATION.—Following a consultation 

16 under paragraph (1), the Committee shall make a de17 termination in writing to the agency, in coordination 

18 with the Office of Management and Budget as nec19 essary, that shall— 

20 (A) include to what degree the proposed cy21 bersecurity requirement or update to the cyberse22 curity requirement aligns with the regulatory 

23 framework; and 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
23 

•S 4630 RS

1 (B) provide a list of recommendations to 

2 improve the cybersecurity requirement and align 

3 it with the regulatory framework. 

4 (3) EXIGENT CIRCUMSTANCES.—In the case of an 

5 exigent circumstance where an agency is authorized 

6 by law to act expeditiously, the agency shall notify 

7 the Committee as soon as possible. 

8 (h) CONSULTATION WITH SECTOR RISK MANAGEMENT

9 AGENCIES.—The Committee shall consult with appropriate 

10 Sector Risk Management Agencies in the development of the 

11 regulatory framework and the implementation of the pilot 

12 program under subsection (f) and shall consult with mem13 bers of industry and critical infrastructure, as appropriate, 

14 for the development of the regulatory framework and pilot 

15 program. 

16 (i) REPORTS.— 

17 (1) ANNUAL REPORT.—Not later than 1 year 

18 after the date of enactment of this Act, and annually 

19 thereafter, the Committee shall submit to the appro20 priate congressional committees a report detailing— 

21 (A) member participation, including the ra22 tionale for any nonparticipation by Committee 

23 members; 

24 (B) the application of the regulatory frame25 work, once developed, on cybersecurity requireVerDate Sep 11 2014 05:49 Dec 03, 2024 Jkt 059200 PO 00000 Frm 00023 Fmt 6652 Sfmt 6203 E:\BILLS\S4630.RS S4630

kjohnson on DSK7ZCZBW3PROD with $$_JOB
24 

•S 4630 RS

1 ments, including consultations or discussions 

2 with regulators; and 

3 (C) any determination made under sub4 section (g)(2). 

5 (2) PILOT PROGRAM REPORT.—Not later than 1 

6 year after the date on which a pilot program under 

7 subsection (f) begins, the Committee shall submit to 

8 the appropriate congressional committees a report de9 tailing— 

10 (A) the cybersecurity requirements selected 

11 for the program, including— 

12 (i) the reasons that the regulatory 

13 agency and cybersecurity requirement were 

14 selected; 

15 (ii) a list of the pilot programs consid16 ered by the Committee; and 

17 (iii) the rationale for selecting the pilot 

18 program; 

19 (B) the information learned from the pro20 gram; 

21 (C) any obstacles encountered during the 

22 program; and 

23 (D) an assessment of the applicability of ex24 panding the program to other agencies and cy25 bersecurity requirements. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
25 

•S 4630 RS

1 SEC. 4. STATUS UPDATES ON INCIDENT REPORTING. 

2 (a) STATUS UPDATE ON MEMORANDA OF AGREE3 MENT.—Not later than 180 days after the date of enactment 

4 of this Act, and not less frequently than every 180 days 

5 thereafter, the Director of the Cybersecurity and Infrastruc6 ture Security Agency shall provide to the appropriate con7 gressional committees a status update on the development 

8 and implementation of documented agreements between 

9 agencies required under section 104(a)(5) of the Cyber Inci10 dent Reporting for Critical Infrastructure Act of 2022 (6 

11 U.S.C. 681g(a)(5)). 

12 (b) YEARLY BRIEFING ON ACTIVITIES OF THE CYBER

13 INCIDENT REPORTING COUNCIL.—Section 2246 of the 

14 Homeland Security Act of 2002 (6 U.S.C. 681f) is amend15 ed— 

16 (1) by redesignating subsection (b) as subsection 

17 (c); and 

18 (2) by inserting after subsection (a) the fol19 lowing: 

20 ‘‘(b) Not later than 1 year after the date of enactment 

21 of the Streamlining Federal Cybersecurity Regulations Act, 

22 and not less frequently than every 1 year thereafter, the Sec23 retary shall brief the Committee on Homeland Security and 

24 Governmental Affairs of the Senate and the Committee on 

25 Homeland Security of the House of Representatives on the 

26 activities of the Cyber Incident Reporting Council.’’. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB
26 

•S 4630 RS

1 SEC. 5. RULE OF CONSTRUCTION. 

2 Nothing in this Act shall be construed— 

3 (1) to expand or alter the existing regulatory au4 thorities of any agency, including any independent 

5 regulatory agency, except for exemptions under sec6 tion 3(f) to implement the pilot program established 

7 under that section; or 

8 (2) to provide any such agency any new or addi9 tional regulatory authorities. 


kjohnson on DSK7ZCZBW3PROD with $$_JOB

kjohnson on DSK7ZCZBW3PROD with $$_JOB
Calendar No. 655 

118TH CONGRESS 

2D SESSION S. 4630 

[Report No. 118–254] 

A BILL 

To establish an interagency committee to harrelating to cybersecurity, and for other purposes. monize regulatory regimes in the United States 

DECEMBER 2, 2024 

Reported with an amendment 


kjohnson on DSK7ZCZBW3PROD with $$_JOB