I 
118TH CONGRESS 
2D SESSION H. R. 10123 
To establish an interagency committee to harmonize regulatory regimes in 
the United States relating to cybersecurity, and for other purposes. 
IN THE HOUSE OF REPRESENTATIVES 
NOVEMBER 14, 2024 
Mr. HIGGINS of Louisiana introduced the following bill; which was referred 
to the Committee on Oversight and Accountability, and in addition to the 
Committee on Homeland Security, for a period to be subsequently deter-
mined by the Speaker, in each case for consideration of such provisions 
as fall within the jurisdiction of the committee concerned 
A BILL 
To establish an interagency committee to harmonize regu-
latory regimes in the United States relating to cybersecu-
rity, and for other purposes. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. SHORT TITLE. 
This Act may be cited as the ‘‘Streamlining Federal 
Cybersecurity Regulations Act’’. 
SEC. 2. DEFINITIONS. 
In this Act: 
VerDate Sep 11 2014 
01:14 Nov 15, 2024
Jkt 059200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H10123.IH
H10123
ssavage on LAPJG3WLY3PROD with BILLS
(1) AGENCY.—The term ‘‘agency’’ has the 
meaning given that term in section 551 of title 5, 
United States Code. 
(2) APPROPRIATE
CONGRESSIONAL
COMMIT-
TEES.—The term ‘‘appropriate congressional com-
mittees’’ means— 
(A) the Committee on Homeland Security 
and Governmental Affairs of the Senate; 
(B) the Committee on Oversight and Ac-
countability of the House of Representatives; 
(C) each committee of Congress with juris-
diction over the activities of a regulatory agen-
cy; and 
(D) each committee of Congress with juris-
diction over the activities of a Sector Risk Man-
agement Agency with respect to a sector regu-
lated by a regulatory agency. 
(3) 
COMMITTEE.—The 
term 
‘‘Committee’’ 
means the Harmonization Committee established 
under section 3(a). 
(4) CYBERSECURITY REQUIREMENT.—The term 
‘‘cybersecurity requirement’’ means an administra-
tive, technical, or physical safeguard, requirement, 
or supervisory activity, including regulations, guid-
ance, bulletins, or examinations, relating to informa-
VerDate Sep 11 2014 
01:14 Nov 15, 2024
Jkt 059200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H10123.IH
H10123
ssavage on LAPJG3WLY3PROD with BILLS
tion security, security of information technology or 
operational technology, cybersecurity, or cyber risk 
or resilience. 
(5) HARMONIZATION.— 
(A) DEFINITION.—The term ‘‘harmoni-
zation’’ means the process of aligning cyberse-
curity requirements issued by regulatory agen-
cies such that the requirements consist of— 
(i) a common set of minimum require-
ments that may apply across sectors and 
that can be updated periodically to address 
new or evolving risks relating to informa-
tion security or cybersecurity; and 
(ii) sector-specific requirements, which 
may include performance-based require-
ments, that— 
(I) are necessary to address sec-
tor-specific risks that are not ade-
quately addressed by the minimum re-
quirements described in clause (i); 
and 
(II) are substantially similar, 
where appropriate, to other require-
ments in that sector or a similar sec-
tor. 
VerDate Sep 11 2014 
01:14 Nov 15, 2024
Jkt 059200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H10123.IH
H10123
ssavage on LAPJG3WLY3PROD with BILLS
(B) RULE OF CONSTRUCTION.—Nothing in 
this definition shall be construed to exempt reg-
ulatory agencies from any otherwise applicable 
processes or laws relating to updating regula-
tions, including subchapter II of chapter 5, and 
chapter 7, of title 5, United States Code (com-
monly known as the ‘‘Administrative Procedure 
Act’’). 
(6) INDEPENDENT REGULATORY AGENCY.—The 
term ‘‘independent regulatory agency’’ has the 
meaning given that term in section 3502 of title 44, 
United States Code. 
(7) RECIPROCITY.—The term ‘‘reciprocity’’ 
means the recognition or acceptance by 1 regulatory 
agency of an assessment, determination, examina-
tion, finding, or conclusion of another regulatory 
agency for determining that a regulated entity has 
complied with a cybersecurity requirement. 
(8) REGULATORY AGENCY.—The term ‘‘regu-
latory agency’’ means— 
(A) any independent regulatory agency 
that has the statutory authority to issue or en-
force any mandatory cybersecurity requirement; 
or 
VerDate Sep 11 2014 
01:14 Nov 15, 2024
Jkt 059200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6201
E:\BILLS\H10123.IH
H10123
ssavage on LAPJG3WLY3PROD with BILLS
(B) any other agency that has the statu-
tory authority to issue or enforce any cyberse-
curity requirement. 
(9) REGULATORY
FRAMEWORK.—The term 
‘‘regulatory framework’’ means the framework devel-
oped under section 3(e)(1). 
(10) SECTOR
RISK
MANAGEMENT
AGENCY.— 
The term ‘‘Sector Risk Management Agency’’ has 
the meaning given that term in section 2200 of the 
Homeland Security Act of 2002 (6 U.S.C. 650). 
SEC. 3. ESTABLISHMENT OF INTERAGENCY COMMITTEE TO 
HARMONIZE REGULATORY REGIMES IN THE 
UNITED STATES RELATING TO CYBERSECU-
RITY. 
(a) HARMONIZATION COMMITTEE.— 
(1) IN GENERAL.—The National Cyber Director 
shall establish an interagency committee to be 
known as the Harmonization Committee to enhance 
the harmonization of cybersecurity requirements 
that are applicable within the United States. 
(2) SUPPORT.—The National Cyber Director 
shall provide the Committee with administrative and 
management support as appropriate. 
(b) MEMBERS.— 
VerDate Sep 11 2014 
01:14 Nov 15, 2024
Jkt 059200
PO 00000
Frm 00005
Fmt 6652
Sfmt 6201
E:\BILLS\H10123.IH
H10123
ssavage on LAPJG3WLY3PROD with BILLS
(1) IN
GENERAL.—The Committee shall be 
composed of— 
(A) the National Cyber Director; 
(B) the head of each regulatory agency; 
(C) the head of the Office of Information 
and Regulatory Affairs of the Office of Manage-
ment and Budget; and 
(D) the head of other appropriate agencies, 
as determined by the chair of the Committee. 
(2) PUBLICATION OF LIST OF MEMBERS.—The 
Committee shall maintain, on a publicly available 
website, a list of the agencies that are represented 
on the Committee, and shall update the list as mem-
bers are added or removed. 
(c) CHAIR.—The National Cyber Director shall be 
the chair of the Committee. 
(d) CHARTER.—The Committee shall develop, deliver 
to Congress, and make publicly available a charter, which 
shall— 
(1) include the processes and rules of the Com-
mittee; and 
(2) detail— 
(A) the objective and scope of the Com-
mittee; and 
(B) other items as necessary. 
VerDate Sep 11 2014 
01:14 Nov 15, 2024
Jkt 059200
PO 00000
Frm 00006
Fmt 6652
Sfmt 6201
E:\BILLS\H10123.IH
H10123
ssavage on LAPJG3WLY3PROD with BILLS
(e) REGULATORY
FRAMEWORK
FOR
HARMONI-
ZATION.— 
(1) IN GENERAL.— 
(A) FRAMEWORK.— 
(i) IN GENERAL.—Not later than 1 
year after the date of enactment of this 
Act, the Committee shall develop a regu-
latory framework for achieving harmoni-
zation of the cybersecurity requirements of 
each regulatory agency. 
(ii) DEVELOPMENT.—The process for 
developing such regulatory framework shall 
include the opportunity for public comment 
and consultation with industry experts and 
other stakeholders. 
(B) FACTORS.—In developing the frame-
work under subparagraph (A), the Committee 
shall account for existing sector-specific cyber-
security requirements that are identified as 
unique or critical to a sector. 
(2) MINIMUM REQUIREMENTS.—The framework 
shall contain, at a minimum, processes for— 
(A) establishing a reciprocal compliance 
mechanism for minimum requirements relating 
to information security or cybersecurity for en-
VerDate Sep 11 2014 
01:14 Nov 15, 2024
Jkt 059200
PO 00000
Frm 00007
Fmt 6652
Sfmt 6201
E:\BILLS\H10123.IH
H10123
ssavage on LAPJG3WLY3PROD with BILLS
tities regulated by more than 1 regulatory agen-
cy; 
(B) identifying cybersecurity requirements 
that are overly burdensome, inconsistent, or 
contradictory, as determined by the Committee; 
and 
(C) developing recommendations for updat-
ing regulations, guidance, and examinations to 
address overly burdensome, inconsistent, or con-
tradictory cybersecurity requirements identified 
under subparagraph (B) to achieve harmoni-
zation. 
(3) PUBLICATION.—Upon completion of the 
regulatory framework, the Committee shall publish 
the regulatory framework in the Federal Register. 
(f) PILOT PROGRAM ON IMPLEMENTATION OF REGU-
LATORY FRAMEWORK.— 
(1) IN GENERAL.—Not fewer than 3 regulatory 
agencies, selected by the Committee, shall carry out 
a pilot program to implement the regulatory frame-
work with respect to not fewer than 3 cybersecurity 
requirements. 
(2) PARTICIPATION BY REGULATORY AGENCIES 
AND REGULATED ENTITIES.— 
VerDate Sep 11 2014 
01:14 Nov 15, 2024
Jkt 059200
PO 00000
Frm 00008
Fmt 6652
Sfmt 6201
E:\BILLS\H10123.IH
H10123
ssavage on LAPJG3WLY3PROD with BILLS
(A) REGULATORY
AGENCIES.—Participa-
tion in the pilot program by a regulatory agen-
cy shall be voluntary and subject to the consent 
of the regulatory agency following selection by 
the Committee under paragraph (1). 
(B) REGULATED ENTITIES.—Participation 
in the pilot program by a regulated entity shall 
be voluntary. 
(3) SELECTION OF CYBERSECURITY REQUIRE-
MENTS.—Cybersecurity requirements selected for the 
pilot program under paragraph (1) shall contain 
substantially similar or substantially related require-
ments such that not fewer than 2 of the selected cy-
bersecurity requirements govern the same regulated 
entity with substantially similar or substantially re-
lated requirements relating to information security 
or cybersecurity. 
(4) WAIVERS.— 
(A) IN
GENERAL.—Notwithstanding any 
provision of subchapter II of chapter 5, and 
chapter 7, of title 5, United States Code (com-
monly known as the ‘‘Administrative Procedure 
Act’’) and subject to the consent of any partici-
pating regulated entity, in implementing the 
pilot program under paragraph (1), a regu-
VerDate Sep 11 2014 
01:14 Nov 15, 2024
Jkt 059200
PO 00000
Frm 00009
Fmt 6652
Sfmt 6201
E:\BILLS\H10123.IH
H10123
ssavage on LAPJG3WLY3PROD with BILLS
latory agency participating in the pilot program 
shall have the authority, as the regulatory agen-
cy determines appropriate, to both issue waivers 
and establish alternative procedures for regu-
lated entities participating in the pilot program 
with respect to the cybersecurity requirements 
included under the pilot program. 
(B) COMPLIANCE.—A regulated entity that 
notifies a regulator of the entity’s participation 
in a pilot program shall be deemed in compli-
ance with the waived requirements to the extent 
that the entity complies with requirements of 
the pilot program. 
(5) SUBSEQUENT PILOT PROGRAM.—The Com-
mittee may only authorize an additional pilot pro-
gram after the later of— 
(A) the date of the conclusion of all 3 ini-
tial pilot programs under paragraph (1); and 
(B) the date of submission of all reports 
required under subsection (i) for each initial 
pilot program. 
(g) CONSULTATION WITH THE COMMITTEE.— 
(1) IN GENERAL.—Notwithstanding any other 
provision of law— 
VerDate Sep 11 2014 
01:14 Nov 15, 2024
Jkt 059200
PO 00000
Frm 00010
Fmt 6652
Sfmt 6201
E:\BILLS\H10123.IH
H10123
ssavage on LAPJG3WLY3PROD with BILLS
(A) except when an exigent circumstance 
described in paragraph (3) exists, before pre-
scribing any cybersecurity requirement, the 
head of a regulatory agency shall consult with 
the Committee regarding such requirement and 
the regulatory framework; and 
(B) independent regulatory agencies, when 
updating any existing cybersecurity requirement 
or issuing a potential new cybersecurity require-
ment, shall consult the Committee during the 
development of the updated cybersecurity re-
quirement or the new cybersecurity requirement 
to ensure that the requirement is aligned to the 
greatest extent possible with the regulatory 
framework. 
(2) CONSULTATION REPORT.—Following a con-
sultation under paragraph (1), the Committee, in co-
ordination with the Office of Management and 
Budget as necessary, shall provide to the agency a 
report that shall— 
(A) include to what degree the proposed 
cybersecurity requirement or update to the cy-
bersecurity requirement aligns with the regu-
latory framework, taking into consideration the 
authorities of the agency; and 
VerDate Sep 11 2014 
01:14 Nov 15, 2024
Jkt 059200
PO 00000
Frm 00011
Fmt 6652
Sfmt 6201
E:\BILLS\H10123.IH
H10123
ssavage on LAPJG3WLY3PROD with BILLS
(B) provide a list of recommendations to 
improve the cybersecurity requirement and to 
align the cybersecurity requirement with the 
regulatory framework. 
(3) EXIGENT CIRCUMSTANCES.—In the case of 
an exigent circumstance where an agency is author-
ized by law to act expeditiously, the agency shall no-
tify the Committee as soon as possible. 
(h) CONSULTATION WITH SECTOR RISK MANAGE-
MENT AGENCIES.—The Committee shall consult with ap-
propriate Sector Risk Management Agencies in the devel-
opment of the regulatory framework and the implementa-
tion of the pilot program under subsection (f) and shall 
consult with members of industry and critical infrastruc-
ture, as appropriate, for the development of the regulatory 
framework and pilot program. 
(i) REPORTS.— 
(1) ANNUAL REPORT.—Not later than 1 year 
after the date of enactment of this Act, and annually 
thereafter, the Committee shall submit to the appro-
priate congressional committees a report detailing— 
(A) member participation, including the ra-
tionale for any nonparticipation by Committee 
members; 
VerDate Sep 11 2014 
01:14 Nov 15, 2024
Jkt 059200
PO 00000
Frm 00012
Fmt 6652
Sfmt 6201
E:\BILLS\H10123.IH
H10123
ssavage on LAPJG3WLY3PROD with BILLS
(B) the application of the regulatory 
framework, once developed, on cybersecurity re-
quirements, including consultations or discus-
sions with regulators; and 
(C) any report made under subsection 
(g)(2). 
(2) PILOT PROGRAM REPORT.—Not later than 
1 year after the date on which a pilot program 
under subsection (f) begins, the Committee shall 
submit to the appropriate congressional committees 
a report detailing— 
(A) the cybersecurity requirements selected 
for the program, including— 
(i) the reasons that the regulatory 
agency and cybersecurity requirement were 
selected; 
(ii) a list of the pilot programs consid-
ered by the Committee; and 
(iii) the rationale for selecting the 
pilot program; 
(B) the information learned from the pro-
gram; 
(C) any obstacles encountered during the 
program; and 
VerDate Sep 11 2014 
01:14 Nov 15, 2024
Jkt 059200
PO 00000
Frm 00013
Fmt 6652
Sfmt 6201
E:\BILLS\H10123.IH
H10123
ssavage on LAPJG3WLY3PROD with BILLS
(D) an assessment of the applicability of 
expanding the program to other agencies and 
cybersecurity requirements. 
SEC. 4. STATUS UPDATES ON INCIDENT REPORTING. 
(a) STATUS UPDATE ON MEMORANDA OF AGREE-
MENT.—Not later than 180 days after the date of enact-
ment of this Act, and not less frequently than every 180 
days thereafter until the date that is 1 year after the date 
that the final rule required under section 2242 of the 
Homeland Security Act of 2002 (6 U.S.C. 681b) is pub-
lished in the Federal Register, the Director of the Cyber-
security and Infrastructure Security Agency shall provide 
to the appropriate congressional committees a status up-
date on the development and implementation of docu-
mented agreements between agencies required under sec-
tion 104(a)(5) of the Cyber Incident Reporting for Critical 
Infrastructure Act of 2022 (6 U.S.C. 681g(a)(5)). 
(b) YEARLY BRIEFING
ON ACTIVITIES
OF
THE 
CYBER INCIDENT REPORTING COUNCIL.—Section 2246 of 
the Homeland Security Act of 2002 (6 U.S.C. 681f) is 
amended— 
(1) by redesignating subsection (b) as sub-
section (c); and 
(2) by inserting after subsection (a) the fol-
lowing: 
VerDate Sep 11 2014 
01:14 Nov 15, 2024
Jkt 059200
PO 00000
Frm 00014
Fmt 6652
Sfmt 6201
E:\BILLS\H10123.IH
H10123
ssavage on LAPJG3WLY3PROD with BILLS
‘‘(b) Not later than 1 year after the date of enact-
ment of the Streamlining Federal Cybersecurity Regula-
tions Act, and not less frequently than every 1 year there-
after until the date that is 7 years after the date of enact-
ment of such Act, the Secretary shall brief the Committee 
on Homeland Security and Governmental Affairs of the 
Senate and the Committee on Homeland Security of the 
House of Representatives on the activities of the Cyber 
Incident Reporting Council.’’. 
SEC. 5. RULE OF CONSTRUCTION. 
Nothing in this Act shall be construed— 
(1) to expand or alter the existing regulatory 
authorities of any agency, including any independent 
regulatory agency, except for exemptions under sec-
tion 3(f) to implement the pilot program established 
under that section; or 
(2) to provide any such agency any new or ad-
ditional regulatory authorities. 
Æ 
VerDate Sep 11 2014 
01:14 Nov 15, 2024
Jkt 059200
PO 00000
Frm 00015
Fmt 6652
Sfmt 6301
E:\BILLS\H10123.IH
H10123
ssavage on LAPJG3WLY3PROD with BILLS