,,ii #aahth ,,congress #b;d ,session ,s4 #dfcj ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #h1 #bjbd,mr4 ,peters 7for himself and ,mr4 ,lankford7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to establish an interagency committee to harmonize regulatory regimes in the ,united ,states relating to cybersecurity1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,streamlining ,federal ,cybersecurity ,regulations ,act4 #b4 ,definitions ,in this ,act3 7#a7 ,agency ,the term agency has the meaning given that term in section #eea of title #e1 ,united ,states ,code4 7#b7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,b7 the ,committee on ,oversight and ,accountability of the ,house of ,representatives2 7,c7 each committee of ,congress with jurisdiction over the activities of a regulatory agency2 and 7,d7 each committee of ,congress with jurisdiction over the activities of a ,sector ,risk ,management ,agency with respect to a sector regulated by a regulatory agency4 7#c7 ,committee ,the term ,committee means the ,harmonization ,committee established under section #c7;a74 7#d7 ,cybersecurity requirement ,the term cybersecurity requirement means an administrative1 technical1 or physical safeguard1 requirement1 or supervisory activity1 including regulations1 guidance1 bulletins or examinations1 relating to information security1 information technology1 cybersecurity1 or cyber risk or resilience4 7#e7 ,harmonization 7,a7 ,definition ,the term harmonization means the process of aligning cybersecurity requirements issued by regulatory agencies such that the requirements consist of-- 7i7 a common set of minimum requirements that apply across sectors and that can be updated periodically to address new or evolving risks relating to information security or cybersecurity2 and 7ii7 sector-specific requirements that-- 7,i7 are necessary to address sector-specific risks that are not adequately addressed by the minimum requirements in clause 7i72 and 7,,ii7 are substantially similar1 where appropriate1 to other requirements in that sector or a similar sector4 7,b7 ,rule of construction ,nothing in this definition shall be construed to exempt regulatory agencies from any otherwise applicable processes or laws relating to updating regulations1 including subchapter ,,ii of chapter #e1 and chapter #g1 of title #e1 ,united ,states ,code 7commonly known as the ,administrative ,procedure ,act74 7#f7 ,independent regulatory agency ,the term independent regulatory agency has the meaning given that term in section #cejb of title #dd1 ,united ,states ,code4 7#g7 ,reciprocity ,the term reciprocity means the recognition or acceptance by #a regulatory agency of an assessment1 determination1 examination1 finding1 or conclusion of another regulatory agency for determining that a regulated entity has complied with a cybersecurity requirement4 7#h7 ,regulatory agency ,the term regulatory agency means-- 7,a7 any independent regulatory agency that has the statutory authority to issue or enforce any mandatory cybersecurity requirement2 or 7,b7 any other agency that has the statutory authority to issue or enforce any cybersecurity requirement4 7#i7 ,regulatory ,framework ,the term regulatory framework means the framework developed under section #c7;e77#a74 7#aj7 ,sector risk management agency ,the term ,sector ,risk ,management ,agency has the meaning given that term in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej74 #c4 ,establishment of interagency committee to harmonize regulatory regimes in the ,united ,states relating to cybersecurity 7a7 ,harmonization ,committee 7#a7 ,in general ,the ,national ,cyber ,director shall establish an interagency committee to be known as the ,harmonization ,committee to enhance the harmonization of cybersecurity requirements that are applicable within the ,united ,states4 7#b7 ,support ,the ,national ,cyber ,director shall provide the ,committee with administrative and management support as appropriate4 7b7 ,members 7#a7 ,in general ,the ,committee shall be composed of-- 7,a7 the ,national ,cyber ,director2 7,b7 the head of each regulatory agency2 7,c7 the head of the ,office of ,information and ,regulatory ,affairs of the ,office of ,management and ,budget2 and 7,d7 the head of other appropriate agencies1 as determined by the chair of the ,committee4 7#b7 ,publication of list of members ,the ,committee shall maintain a list of the agencies that are represented on the ,committee on a publicly available website4 7c7 ,chair ,the ,national ,cyber ,director shall be the chair of the ,committee4 7d7 ,charter ,the ,committee shall develop1 deliver to ,congress1 and make publicly available a charter1 which shall-- 7#a7 include the processes and rules of the ,committee2 and 7#b7 detail-- 7,a7 the objective and scope of the ,committee2 and 7,b7 other items as necessary4 7e7 ,regulatory framework for harmonization 7#a7 ,in general 7,a7 ,framework ,not later than #a year after the date of enactment of this ,act1 the ,committee shall develop a regulatory framework for achieving harmonization of the cybersecurity requirements of each regulatory agency4 7,b7 ,factors ,in developing the framework under subparagraph 7,a71 the ,committee shall account for existing sector-specific cybersecurity requirements that are identified as unique or critical to a sector4 7#b7 ,minimum requirements ,the framework shall contain1 at a minimum1 processes for-- 7,a7 establishing a reciprocal compliance mechanism for minimum requirements relating to information security or cybersecurity for entities regulated by more than #a regulatory agency2 7,b7 identifying cybersecurity requirements that are overly burdensome1 inconsistent1 or contradictory1 as determined by the ,committee2 and 7,c7 developing recommendations for updating regulations1 guidance1 and examinations to address overly burdensome1 inconsistent1 or contradictory cybersecurity requirements identified under subparagraph 7,b7 to achieve harmonization4 7#c7 ,publication ,upon completion of the regulatory framework1 the ,committee shall publish the regulatory framework in the ,federal ,register4 7f7 ,pilot program on implementation of regulatory framework 7#a7 ,in general ,not fewer than #c regulatory agencies1 selected by the ,committee1 shall carry out a pilot program to implement the regulatory framework established under subsection 7e7 with respect to not fewer than #c cybersecurity requirements4 7#b7 ,participation by regulatory agencies and regulated entities 7,a7 ,regulatory agencies ,participation in the pilot program by a regulatory agency shall be voluntary and subject to the consent of the regulatory agency following selection by the ,committee under paragraph 7#a74 7,b7 ,regulated entities ,participation in the pilot program by a regulated entity shall be voluntary4 7#c7 ,selection of cybersecurity requirements ,cybersecurity requirements selected for the pilot program under paragraph 7#a7 shall contain substantially similar or substantially related requirements such that not fewer than #b of the selected cybersecurity requirements govern the same regulated entity with substantially similar or substantially related requirements relating to information security or cybersecurity4 7#d7 ,waivers ,notwithstanding any provision of subchapter ,,ii of chapter #e1 and chapter #g1 of title #e1 ,united ,states ,code 7commonly known as the ,administrative ,procedure ,act7 and subject to the consent of any participating regulated entity1 in implementing the pilot program under paragraph 7#a71 a regulatory agency participating in the pilot program shall have the authority to issue waivers and establish alternative procedures for regulated entities participating in the pilot program with respect to the cybersecurity requirements included under the pilot program4 7g7 ,consultation with the ,committee 7#a7 ,in general ,notwithstanding any other provision of law-- 7,a7 before prescribing any cybersecurity requirement1 the head of a regulatory agency shall consult with the ,committee regarding such requirement and the regulatory framework established under subsection 7e72 and 7,b7 independent regulatory agencies1 when updating any existing cybersecurity requirement or issuing a potential new cybersecurity requirement1 shall consult the ,committee during the development of the updated cybersecurity requirement or the new cybersecurity requirement to ensure that the requirement is aligned to the greatest extent possible with the regulatory framework4 7#b7 ,determination ,following a consultation under paragraph 7#a71 the ,committee shall make a determination in writing to the agency1 in coordination with the ,office of ,management and ,budget as necessary1 that shall-- 7,a7 include to what degree the proposed cybersecurity requirement or update to the cybersecurity requirement aligns with the regulatory framework2 and 7,b7 provide a list of recommendations to improve the cybersecurity requirement and align it with the regulatory framework4 7h7 ,consultation with sector risk management agencies ,the ,committee shall consult with appropriate ,sector ,risk ,management ,agencies in the development of the regulatory framework under subsection 7e7 and the implementation of the pilot program under subsection 7f74 7i7 ,reports 7#a7 ,annual report ,not later than #ab months after the date of enactment of this ,act1 and annually thereafter1 the ,committee shall submit to the appropriate congressional committees a report detailing-- 7,a7 member participation2 and 7,b7 the application of the regulatory framework1 once developed1 on cybersecurity requirements1 including consultations or discussions with regulators4 7#b7 ,pilot program report ,not later than #ab months after the date on which the pilot program begins1 the ,committee shall submit to the appropriate congressional committees a report detailing-- 7,a7 the cybersecurity requirements selected for the program1 including the reasons that the regulatory agency and cybersecurity requirement were selected2 7,b7 the information learned from the program2 7,c7 any obstacles encountered during the program2 and 7,d7 an assessment of the applicability of expanding the program to other agencies and cybersecurity requirements4 #d4 ,status updates on incident reporting 7a7 ,status update on memoranda of agreement ,not later than #ahj days after the date of enactment of this ,act1 and not less frequently than every #ahj days thereafter1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall provide to the appropriate congressional committees a status update on the development and implementation of memoranda of agreement between agencies required under section #ajd7;a77#e7 of the ,cyber ,incident ,reporting for ,critical ,infrastructure ,act of #bjbb 7#f ,u4,s4,c4 #fha;g7a77#e774 7b7 ,status update on efforts of the ,cyber ,incident ,reporting ,council ,not later than #ahj days after the date of enactment of this ,act1 and not less frequently than every #ahj days thereafter1 the ,secretary of ,homeland ,security shall provide to the appropriate congressional committees a status update on the efforts of the ,cyber ,incident ,reporting ,council established under section #bbdf of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fha;f74 #e4 ,rule of construction ,nothing in this ,act shall be construed-- 7#a7 to expand or alter the existing regulatory authorities of any agency1 including any independent regulatory agency1 except for exemptions under section #c7;f7 to implement the pilot program established under that section2 7#b7 to provide any such agency any new or additional regulatory authorities2 or 7#c7 to address security incident reporting requirements subject to coordination by the ,cyber ,incident ,reporting ,council established under section #bbdf of the ,homeland ,security ,act of #bjbb 7#f ,u4,s4,c4 #fha;f71 except for the required status updates under section #d4