,,ii ,calendar ,no4 #fee #aahth ,,congress #b;d ,session ,s4 #dfcj ,report ,no4 #aah-bed ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,july #h1 #bjbd,mr4 ,peters 7for himself1 ,mr4 ,lankford1 ,ms4 ,rosen1 and ,mr4 ,king7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,december #b1 #bjbd,reported by ,mr4 ,peters1 with an amendment,strike out all after the enacting clause and insert the part printed in italic ,a ,,bill ,to establish an interagency committee to harmonize regulatory regimes in the ,united ,states relating to cybersecurity1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,streamlining ,federal ,cybersecurity ,regulations ,act4 #b4 ,definitions ,in this ,act3 7#a7 ,agency ,the term agency has the meaning given that term in section #eea of title #e1 ,united ,states ,code4 7#b7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,b7 the ,committee on ,oversight and ,accountability of the ,house of ,representatives2 7,c7 each committee of ,congress with jurisdiction over the activities of a regulatory agency2 and 7,d7 each committee of ,congress with jurisdiction over the activities of a ,sector ,risk ,management ,agency with respect to a sector regulated by a regulatory agency4 7#c7 ,committee ,the term ,committee means the ,harmonization ,committee established under section #c7;a74 7#d7 ,cybersecurity requirement ,the term cybersecurity requirement means an administrative1 technical1 or physical safeguard1 requirement1 or supervisory activity1 including regulations1 guidance1 bulletins or examinations1 relating to information security1 information technology1 cybersecurity1 or cyber risk or resilience4 7#e7 ,harmonization 7,a7 ,definition ,the term harmonization means the process of aligning cybersecurity requirements issued by regulatory agencies such that the requirements consist of-- 7i7 a common set of minimum requirements that apply across sectors and that can be updated periodically to address new or evolving risks relating to information security or cybersecurity2 and 7ii7 sector-specific requirements that-- 7,i7 are necessary to address sector-specific risks that are not adequately addressed by the minimum requirements in clause 7i72 and 7,,ii7 are substantially similar1 where appropriate1 to other requirements in that sector or a similar sector4 7,b7 ,rule of construction ,nothing in this definition shall be construed to exempt regulatory agencies from any otherwise applicable processes or laws relating to updating regulations1 including subchapter ,,ii of chapter #e1 and chapter #g1 of title #e1 ,united ,states ,code 7commonly known as the ,administrative ,procedure ,act74 7#f7 ,independent regulatory agency ,the term independent regulatory agency has the meaning given that term in section #cejb of title #dd1 ,united ,states ,code4 7#g7 ,reciprocity ,the term reciprocity means the recognition or acceptance by #a regulatory agency of an assessment1 determination1 examination1 finding1 or conclusion of another regulatory agency for determining that a regulated entity has complied with a cybersecurity requirement4 7#h7 ,regulatory agency ,the term regulatory agency means-- 7,a7 any independent regulatory agency that has the statutory authority to issue or enforce any mandatory cybersecurity requirement2 or 7,b7 any other agency that has the statutory authority to issue or enforce any cybersecurity requirement4 7#i7 ,regulatory ,framework ,the term regulatory framework means the framework developed under section #c7;e77#a74 7#aj7 ,sector risk management agency ,the term ,sector ,risk ,management ,agency has the meaning given that term in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej74 #c4 ,establishment of interagency committee to harmonize regulatory regimes in the ,united ,states relating to cybersecurity 7a7 ,harmonization ,committee 7#a7 ,in general ,the ,national ,cyber ,director shall establish an interagency committee to be known as the ,harmonization ,committee to enhance the harmonization of cybersecurity requirements that are applicable within the ,united ,states4 7#b7 ,support ,the ,national ,cyber ,director shall provide the ,committee with administrative and management support as appropriate4 7b7 ,members 7#a7 ,in general ,the ,committee shall be composed of-- 7,a7 the ,national ,cyber ,director2 7,b7 the head of each regulatory agency2 7,c7 the head of the ,office of ,information and ,regulatory ,affairs of the ,office of ,management and ,budget2 and 7,d7 the head of other appropriate agencies1 as determined by the chair of the ,committee4 7#b7 ,publication of list of members ,the ,committee shall maintain a list of the agencies that are represented on the ,committee on a publicly available website4 7c7 ,chair ,the ,national ,cyber ,director shall be the chair of the ,committee4 7d7 ,charter ,the ,committee shall develop1 deliver to ,congress1 and make publicly available a charter1 which shall-- 7#a7 include the processes and rules of the ,committee2 and 7#b7 detail-- 7,a7 the objective and scope of the ,committee2 and 7,b7 other items as necessary4 7e7 ,regulatory framework for harmonization 7#a7 ,in general 7,a7 ,framework ,not later than #a year after the date of enactment of this ,act1 the ,committee shall develop a regulatory framework for achieving harmonization of the cybersecurity requirements of each regulatory agency4 7,b7 ,factors ,in developing the framework under subparagraph 7,a71 the ,committee shall account for existing sector-specific cybersecurity requirements that are identified as unique or critical to a sector4 7#b7 ,minimum requirements ,the framework shall contain1 at a minimum1 processes for-- 7,a7 establishing a reciprocal compliance mechanism for minimum requirements relating to information security or cybersecurity for entities regulated by more than #a regulatory agency2 7,b7 identifying cybersecurity requirements that are overly burdensome1 inconsistent1 or contradictory1 as determined by the ,committee2 and 7,c7 developing recommendations for updating regulations1 guidance1 and examinations to address overly burdensome1 inconsistent1 or contradictory cybersecurity requirements identified under subparagraph 7,b7 to achieve harmonization4 7#c7 ,publication ,upon completion of the regulatory framework1 the ,committee shall publish the regulatory framework in the ,federal ,register4 7f7 ,pilot program on implementation of regulatory framework 7#a7 ,in general ,not fewer than #c regulatory agencies1 selected by the ,committee1 shall carry out a pilot program to implement the regulatory framework established under subsection 7e7 with respect to not fewer than #c cybersecurity requirements4 7#b7 ,participation by regulatory agencies and regulated entities 7,a7 ,regulatory agencies ,participation in the pilot program by a regulatory agency shall be voluntary and subject to the consent of the regulatory agency following selection by the ,committee under paragraph 7#a74 7,b7 ,regulated entities ,participation in the pilot program by a regulated entity shall be voluntary4 7#c7 ,selection of cybersecurity requirements ,cybersecurity requirements selected for the pilot program under paragraph 7#a7 shall contain substantially similar or substantially related requirements such that not fewer than #b of the selected cybersecurity requirements govern the same regulated entity with substantially similar or substantially related requirements relating to information security or cybersecurity4 7#d7 ,waivers ,notwithstanding any provision of subchapter ,,ii of chapter #e1 and chapter #g1 of title #e1 ,united ,states ,code 7commonly known as the ,administrative ,procedure ,act7 and subject to the consent of any participating regulated entity1 in implementing the pilot program under paragraph 7#a71 a regulatory agency participating in the pilot program shall have the authority to issue waivers and establish alternative procedures for regulated entities participating in the pilot program with respect to the cybersecurity requirements included under the pilot program4 7g7 ,consultation with the ,committee 7#a7 ,in general ,notwithstanding any other provision of law-- 7,a7 before prescribing any cybersecurity requirement1 the head of a regulatory agency shall consult with the ,committee regarding such requirement and the regulatory framework established under subsection 7e72 and 7,b7 independent regulatory agencies1 when updating any existing cybersecurity requirement or issuing a potential new cybersecurity requirement1 shall consult the ,committee during the development of the updated cybersecurity requirement or the new cybersecurity requirement to ensure that the requirement is aligned to the greatest extent possible with the regulatory framework4 7#b7 ,determination ,following a consultation under paragraph 7#a71 the ,committee shall make a determination in writing to the agency1 in coordination with the ,office of ,management and ,budget as necessary1 that shall-- 7,a7 include to what degree the proposed cybersecurity requirement or update to the cybersecurity requirement aligns with the regulatory framework2 and 7,b7 provide a list of recommendations to improve the cybersecurity requirement and align it with the regulatory framework4 7h7 ,consultation with sector risk management agencies ,the ,committee shall consult with appropriate ,sector ,risk ,management ,agencies in the development of the regulatory framework under subsection 7e7 and the implementation of the pilot program under subsection 7f74 7i7 ,reports 7#a7 ,annual report ,not later than #ab months after the date of enactment of this ,act1 and annually thereafter1 the ,committee shall submit to the appropriate congressional committees a report detailing-- 7,a7 member participation2 and 7,b7 the application of the regulatory framework1 once developed1 on cybersecurity requirements1 including consultations or discussions with regulators4 7#b7 ,pilot program report ,not later than #ab months after the date on which the pilot program begins1 the ,committee shall submit to the appropriate congressional committees a report detailing-- 7,a7 the cybersecurity requirements selected for the program1 including the reasons that the regulatory agency and cybersecurity requirement were selected2 7,b7 the information learned from the program2 7,c7 any obstacles encountered during the program2 and 7,d7 an assessment of the applicability of expanding the program to other agencies and cybersecurity requirements4 #d4 ,status updates on incident reporting 7a7 ,status update on memoranda of agreement ,not later than #ahj days after the date of enactment of this ,act1 and not less frequently than every #ahj days thereafter1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall provide to the appropriate congressional committees a status update on the development and implementation of memoranda of agreement between agencies required under section #ajd7;a77#e7 of the ,cyber ,incident ,reporting for ,critical ,infrastructure ,act of #bjbb 7#f ,u4,s4,c4 #fha;g7a77#e774 7b7 ,status update on efforts of the ,cyber ,incident ,reporting ,council ,not later than #ahj days after the date of enactment of this ,act1 and not less frequently than every #ahj days thereafter1 the ,secretary of ,homeland ,security shall provide to the appropriate congressional committees a status update on the efforts of the ,cyber ,incident ,reporting ,council established under section #bbdf of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fha;f74 #e4 ,rule of construction ,nothing in this ,act shall be construed-- 7#a7 to expand or alter the existing regulatory authorities of any agency1 including any independent regulatory agency1 except for exemptions under section #c7;f7 to implement the pilot program established under that section2 7#b7 to provide any such agency any new or additional regulatory authorities2 or 7#c7 to address security incident reporting requirements subject to coordination by the ,cyber ,incident ,reporting ,council established under section #bbdf of the ,homeland ,security ,act of #bjbb 7#f ,u4,s4,c4 #fha;f71 except for the required status updates under section #d4 #a4 ,short title ,this ,act may be cited as the ,streamlining ,federal ,cybersecurity ,regulations ,act4 #b4 ,definitions ,in this ,act3 7#a7 ,agency ,the term agency has the meaning given that term in section #eea of title #e1 ,united ,states ,code4 7#b7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,b7 the ,committee on ,oversight and ,accountability of the ,house of ,representatives2 7,c7 each committee of ,congress with jurisdiction over the activities of a regulatory agency2 and 7,d7 each committee of ,congress with jurisdiction over the activities of a ,sector ,risk ,management ,agency with respect to a sector regulated by a regulatory agency4 7#c7 ,committee ,the term ,committee means the ,harmonization ,committee established under section #c7;a74 7#d7 ,cybersecurity requirement ,the term cybersecurity requirement means an administrative1 technical1 or physical safeguard1 requirement1 or supervisory activity1 including regulations1 guidance1 bulletins1 or examinations1 relating to information security1 information technology1 cybersecurity1 or cyber risk or resilience4 7#e7 ,harmonization 7,a7 ,definition ,the term harmonization means the process of aligning cybersecurity requirements issued by regulatory agencies such that the requirements consist of-- 7i7 a common set of minimum requirements that apply across sectors and that can be updated periodically to address new or evolving risks relating to information security or cybersecurity2 and 7ii7 sector-specific requirements1 which may include performance-based requirements1 that-- 7,i7 are necessary to address sector-specific risks that are not adequately addressed by the minimum requirements described in clause 7i72 and 7,,ii7 are substantially similar1 where appropriate1 to other requirements in that sector or a similar sector4 7,b7 ,rule of construction ,nothing in this definition shall be construed to exempt regulatory agencies from any otherwise applicable processes or laws relating to updating regulations1 including subchapter ,,ii of chapter #e1 and chapter #g1 of title #e1 ,united ,states ,code 7commonly known as the ,administrative ,procedure ,act74 7#f7 ,independent regulatory agency ,the term independent regulatory agency has the meaning given that term in section #cejb of title #dd1 ,united ,states ,code4 7#g7 ,reciprocity ,the term reciprocity means the recognition or acceptance by #a regulatory agency of an assessment1 determination1 examination1 finding1 or conclusion of another regulatory agency for determining that a regulated entity has complied with a cybersecurity requirement4 7#h7 ,regulatory agency ,the term regulatory agency means-- 7,a7 any independent regulatory agency that has the statutory authority to issue or enforce any mandatory cybersecurity requirement2 or 7,b7 any other agency that has the statutory authority to issue or enforce any cybersecurity requirement4 7#i7 ,regulatory framework ,the term regulatory framework means the framework developed under section #c7;e77#a74 7#aj7 ,sector risk management agency ,the term ,sector ,risk ,management ,agency has the meaning given that term in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej74 #c4 ,establishment of interagency committee to harmonize regulatory regimes in the ,united ,states relating to cybersecurity 7a7 ,harmonization ,committee 7#a7 ,in general ,the ,national ,cyber ,director shall establish an interagency committee to be known as the ,harmonization ,committee to enhance the harmonization of cybersecurity requirements that are applicable within the ,united ,states4 7#b7 ,support ,the ,national ,cyber ,director shall provide the ,committee with administrative and management support as appropriate4 7b7 ,members 7#a7 ,in general ,the ,committee shall be composed of-- 7,a7 the ,national ,cyber ,director2 7,b7 the head of each regulatory agency2 7,c7 the head of the ,office of ,information and ,regulatory ,affairs of the ,office of ,management and ,budget2 and 7,d7 the head of other appropriate agencies1 as determined by the chair of the ,committee4 7#b7 ,publication of list of members ,the ,committee shall maintain1 on a publicly available website1 a list of the agencies that are represented on the ,committee1 and shall update the list as members are added or removed4 7c7 ,chair ,the ,national ,cyber ,director shall be the chair of the ,committee4 7d7 ,charter ,the ,committee shall develop1 deliver to ,congress1 and make publicly available a charter1 which shall-- 7#a7 include the processes and rules of the ,committee2 and 7#b7 detail-- 7,a7 the objective and scope of the ,committee2 and 7,b7 other items as necessary4 7e7 ,regulatory framework for harmonization 7#a7 ,in general 7,a7 ,framework ,not later than #a year after the date of enactment of this ,act1 the ,committee shall develop a regulatory framework for achieving harmonization of the cybersecurity requirements of each regulatory agency4 7,b7 ,factors ,in developing the framework under subparagraph 7,a71 the ,committee shall account for existing sector-specific cybersecurity requirements that are identified as unique or critical to a sector4 7#b7 ,minimum requirements ,the framework shall contain1 at a minimum1 processes for-- 7,a7 establishing a reciprocal compliance mechanism for minimum requirements relating to information security or cybersecurity for entities regulated by more than #a regulatory agency2 7,b7 identifying cybersecurity requirements that are overly burdensome1 inconsistent1 or contradictory1 as determined by the ,committee2 and 7,c7 developing recommendations for updating regulations1 guidance1 and examinations to address overly burdensome1 inconsistent1 or contradictory cybersecurity requirements identified under subparagraph 7,b7 to achieve harmonization4 7#c7 ,publication ,upon completion of the regulatory framework1 the ,committee shall publish the regulatory framework in the ,federal ,register for public comment4 7f7 ,pilot program on implementation of regulatory framework 7#a7 ,in general ,not fewer than #c regulatory agencies1 selected by the ,committee1 shall carry out a pilot program to implement the regulatory framework with respect to not fewer than #c cybersecurity requirements4 7#b7 ,participation by regulatory agencies and regulated entities 7,a7 ,regulatory agencies ,participation in the pilot program by a regulatory agency shall be voluntary and subject to the consent of the regulatory agency following selection by the ,committee under paragraph 7#a74 7,b7 ,regulated entities ,participation in the pilot program by a regulated entity shall be voluntary4 7#c7 ,selection of cybersecurity requirements ,cybersecurity requirements selected for the pilot program under paragraph 7#a7 shall contain substantially similar or substantially related requirements such that not fewer than #b of the selected cybersecurity requirements govern the same regulated entity with substantially similar or substantially related requirements relating to information security or cybersecurity4 7#d7 ,waivers ,notwithstanding any provision of subchapter ,,ii of chapter #e1 and chapter #g1 of title #e1 ,united ,states ,code 7commonly known as the ,administrative ,procedure ,act7 and subject to the consent of any participating regulated entity1 in implementing the pilot program under paragraph 7#a71 a regulatory agency participating in the pilot program shall have the authority to issue waivers and establish alternative procedures for regulated entities participating in the pilot program with respect to the cybersecurity requirements included under the pilot program4 7#e7 ,subsequent pilot program ,the ,committee may only authorize an additional pilot program after the later of-- 7,a7 the date of the conclusion of all #c initial pilot programs under paragraph 7#a72 and 7,b7 the date of submission of all reports required under subsection 7i7 for each initial pilot program4 7g7 ,consultation with the ,committee 7#a7 ,in general ,notwithstanding any other provision of law-- 7,a7 except when an exigent circumstance described in paragraph 7#c7 exists1 before prescribing any cybersecurity requirement1 the head of a regulatory agency shall consult with the ,committee regarding such requirement and the regulatory framework2 and 7,b7 independent regulatory agencies1 when updating any existing cybersecurity requirement or issuing a potential new cybersecurity requirement1 shall consult the ,committee during the development of the updated cybersecurity requirement or the new cybersecurity requirement to ensure that the requirement is aligned to the greatest extent possible with the regulatory framework4 7#b7 ,determination ,following a consultation under paragraph 7#a71 the ,committee shall make a determination in writing to the agency1 in coordination with the ,office of ,management and ,budget as necessary1 that shall-- 7,a7 include to what degree the proposed cybersecurity requirement or update to the cybersecurity requirement aligns with the regulatory framework2 and 7,b7 provide a list of recommendations to improve the cybersecurity requirement and align it with the regulatory framework4 7#c7 ,exigent circumstances ,in the case of an exigent circumstance where an agency is authorized by law to act expeditiously1 the agency shall notify the ,committee as soon as possible4 7h7 ,consultation with sector risk management agencies ,the ,committee shall consult with appropriate ,sector ,risk ,management ,agencies in the development of the regulatory framework and the implementation of the pilot program under subsection 7f7 and shall consult with members of industry and critical infrastructure1 as appropriate1 for the development of the regulatory framework and pilot program4 7i7 ,reports 7#a7 ,annual report ,not later than #a year after the date of enactment of this ,act1 and annually thereafter1 the ,committee shall submit to the appropriate congressional committees a report detailing-- 7,a7 member participation1 including the rationale for any nonparticipation by ,committee members2 7,b7 the application of the regulatory framework1 once developed1 on cybersecurity requirements1 including consultations or discussions with regulators2 and 7,c7 any determination made under subsection 7g77#b74 7#b7 ,pilot program report ,not later than #a year after the date on which a pilot program under subsection 7f7 begins1 the ,committee shall submit to the appropriate congressional committees a report detailing-- 7,a7 the cybersecurity requirements selected for the program1 including-- 7i7 the reasons that the regulatory agency and cybersecurity requirement were selected2 7ii7 a list of the pilot programs considered by the ,committee2 and 7iii7 the rationale for selecting the pilot program2 7,b7 the information learned from the program2 7,c7 any obstacles encountered during the program2 and 7,d7 an assessment of the applicability of expanding the program to other agencies and cybersecurity requirements4 #d4 ,status updates on incident reporting 7a7 ,status update on memoranda of agreement ,not later than #ahj days after the date of enactment of this ,act1 and not less frequently than every #ahj days thereafter1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency shall provide to the appropriate congressional committees a status update on the development and implementation of documented agreements between agencies required under section #ajd7;a77#e7 of the ,cyber ,incident ,reporting for ,critical ,infrastructure ,act of #bjbb 7#f ,u4,s4,c4 #fha;g7a77#e774 7b7 ,yearly briefing on activities of the ,cyber ,incident ,reporting ,council ,section #bbdf of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fha;f7 is amended-- 7#a7 by redesignating subsection 7b7 as subsection 7c72 and 7#b7 by inserting after subsection 7a7 the following3 7b7 ,not later than #a year after the date of enactment of the ,streamlining ,federal ,cybersecurity ,regulations ,act1 and not less frequently than every #a year thereafter1 the ,secretary shall brief the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate and the ,committee on ,homeland ,security of the ,house of ,representatives on the activities of the ,cyber ,incident ,reporting ,council4 4 #e4 ,rule of construction ,nothing in this ,act shall be construed-- 7#a7 to expand or alter the existing regulatory authorities of any agency1 including any independent regulatory agency1 except for exemptions under section #c7;f7 to implement the pilot program established under that section2 or 7#b7 to provide any such agency any new or additional regulatory authorities4 ,december #b1 #bjbd,reported with an amendment