Cyber Regulatory Harmonization: The Prospects And Potential Impacts Of Current Efforts

Companies in virtually every critical infrastructure sector have to navigate the maze of duplicative, inconsistent, and fragmented cybersecurity regulations imposed by federal and state governments. For example, as we have discussed in previous posts, organizations are subject to a wide range of affirmative cybersecurity requirements from government entities including regulatory agencies, Sector Risk Management Agencies (SMRAs), the Securities and Exchange Commission (SEC), and federal procurement agencies. And on the federal cyber incident reporting front, there are 52 in-effect or proposed federal requirements, with 45 requirements in effect over 22 agencies, according to the 2023 Report on Cyber Incident Reporting Harmonization.