,,ii #aaith ,,congress #ast ,session ,s4 #ahge ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,may #bb1 #bjbe ,mr4 ,peters 7for himself and ,mr4 ,lankford7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to establish an interagency committee to harmonize regulatory regimes in the ,united ,states relating to cybersecurity1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,streamlining ,federal ,cybersecurity ,regulations ,act of #bjbe4 #b4 ,definitions ,in this ,act3 7#a7 ,agency ,the term agency has the meaning given that term in section #cejb of title #dd1 ,united ,states ,code4 7#b7 ,appropriate congressional committees ,the term appropriate congressional committees means-- 7,a7 the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate2 7,b7 the ,committee on ,oversight and ,government ,reform of the ,house of ,representatives2 7,c7 each committee of ,congress with jurisdiction over the activities of a regulatory agency2 and 7,d7 each committee of ,congress with jurisdiction over the activities of a ,sector ,risk ,management ,agency with respect to a sector regulated by a regulatory agency4 7#c7 ,committee ,the term ,committee means the ,harmonization ,committee established under section #c7;a74 7#d7 ,cybersecurity requirement ,the term cybersecurity requirement means a regulation or supervisory activity1 including an examination or binding guidance1 that includes administrative1 technical1 or physical requirements relating to information security1 security of information technology or operational technology1 cybersecurity1 or cyber risk or resilience4 7#e7 ,harmonization 7,a7 ,definition ,the term harmonization means the process of aligning cybersecurity requirements issued by regulatory agencies such that the requirements consist of-- 7i7 a common set of minimum requirements that may apply across sectors and that can be updated periodically to address new or evolving risks relating to information security or cybersecurity2 and 7ii7 sector-specific requirements1 which may include performance-based requirements1 that-- 7,i7 are necessary to address sector-specific risks that are not adequately addressed by the minimum requirements described in clause 7i72 7,,ii7 are substantially similar1 where appropriate1 to other requirements in that sector or a similar sector2 and 7,,iii7 align with international standards1 where appropriate4 7,b7 ,rule of construction ,nothing in this definition shall be construed to exempt regulatory agencies from any otherwise applicable processes or laws relating to promulgating or amending regulations1 including subchapter ,,ii of chapter #e1 and chapter #g1 of title #e1 ,united ,states ,code 7commonly known as the ,administrative ,procedure ,act74 7#f7 ,head ,the term head includes1 in the case of an agency directed by multiple individuals1 such as a commission1 a representative selected by such individuals from among such individuals4 7#g7 ,independent regulatory agency ,the term independent regulatory agency has the meaning given that term in section #cejb of title #dd1 ,united ,states ,code4 7#h7 ,reciprocity ,the term reciprocity means the recognition or acceptance by #a regulatory agency of an assessment1 determination1 examination1 finding1 or conclusion of another regulatory agency for determining that a regulated entity has complied with a cybersecurity requirement4 7#i7 ,regulatory agency ,the term regulatory agency means-- 7,a7 any independent regulatory agency that has the statutory authority to issue or enforce any mandatory cybersecurity requirement2 or 7,b7 any other agency that has the statutory authority to issue or enforce any cybersecurity requirement4 7#aj7 ,regulatory framework ,the term regulatory framework means the framework developed under section #c7;e77#a74 7#aa7 ,sector risk management agency ,the term ,sector ,risk ,management ,agency has the meaning given that term in section #bbjj of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej74 #c4 ,establishment of interagency committee to harmonize regulatory regimes in the ,united ,states relating to cybersecurity 7a7 ,harmonization ,committee 7#a7 ,in general ,the ,national ,cyber ,director shall establish an interagency committee to be known as the ,harmonization ,committee to enhance the harmonization and reciprocity of cybersecurity requirements that are applicable within the ,united ,states1 including the formulation of baseline and sector-specific requirements that are risk-based4 7#b7 ,support ,the ,national ,cyber ,director shall provide the ,committee with administrative and management support as appropriate4 7b7 ,members 7#a7 ,in general ,the ,committee shall be composed of-- 7,a7 the ,national ,cyber ,director2 7,b7 the head of each regulatory agency1 including the ,cybersecurity and ,infrastructure ,security ,agency and the ,national ,institute of ,standards and ,technology2 7,c7 the head of the ,office of ,information and ,regulatory ,affairs of the ,office of ,management and ,budget2 and 7,d7 the head of other appropriate agencies1 as determined by the chair of the ,committee4 7#b7 ,publication of list of members ,the ,committee shall maintain1 on a publicly available website1 a list of the agencies that are represented on the ,committee as determined by the chair of the ,committee1 and shall update the list as members are added or removed4 7c7 ,chair ,the ,national ,cyber ,director shall be the chair of the ,committee4 7d7 ,charter ,the ,committee shall develop1 deliver to ,congress1 and make publicly available a charter1 which shall-- 7#a7 include the processes and rules of the ,committee2 and 7#b7 detail-- 7,a7 the objective and scope of the ,committee2 and 7,b7 other items as necessary4 7e7 ,regulatory framework for harmonization 7#a7 ,in general 7,a7 ,development ,not later than #a year after the date of enactment of this ,act1 the ,committee shall develop a regulatory framework for achieving harmonization of the cybersecurity requirements of each regulatory agency4 7,b7 ,contents ,the regulatory framework developed under clause 7i7 shall-- 7i7 include a common set of baseline cybersecurity requirements across sectors2 and 7ii7 outline common approaches and language for applying cybersecurity requirements promulgated or amended following passage of this ,act4 7,c7 ,public comment ,the process for developing such regulatory framework shall include the opportunity for public comment and consultation with industry experts and other stakeholders4 7,d7 ,factors ,in developing the framework under subparagraph 7,a71 the ,committee shall account for existing sector-specific cybersecurity requirements that are identified as unique or critical to a sector4 7#b7 ,minimum requirements ,the framework shall contain1 at a minimum1 processes for-- 7,a7 establishing a reciprocal compliance mechanism for minimum requirements relating to information security or cybersecurity for entities regulated by more than #a regulatory agency2 7,b7 identifying cybersecurity requirements that are overly burdensome1 inconsistent1 or contradictory1 as determined by the ,committee2 7,c7 developing recommendations for updating regulations1 guidance1 and examinations to address overly burdensome1 inconsistent1 or contradictory cybersecurity requirements identified under subparagraph 7,b7 to achieve harmonization2 and 7,d7 drafting baseline requirements and regulatory language for covered agencies to use1 as appropriate4 7#c7 ,publication ,upon completion of the regulatory framework1 the ,committee shall publish the regulatory framework in the ,federal ,register4 7f7 ,pilot program on implementation of regulatory framework 7#a7 ,in general ,not later than #ij days after the publication of the framework developed under subsection 7e71 not fewer than #c regulatory agencies but not more than #e regulatory agencies1 selected by the ,committee1 shall carry out a pilot program to implement the regulatory framework with respect to not fewer than #c cybersecurity requirements but not more than #f cybersecurity requirements1 with at least #a requirement from each regulatory agency4 7#b7 ,duration ,the duration of the pilot program shall be determined by the ,harmonization ,committee in coordination with the pilot program participants4 7#c7 ,participation by regulatory agencies and regulated entities 7,a7 ,regulatory agencies ,participation in the pilot program by a regulatory agency shall be voluntary and subject to the consent of the regulatory agency following selection by the ,committee under paragraph 7#a74 7,b7 ,regulated entities ,participation in the pilot program by a regulated entity shall be voluntary4 7#d7 ,selection of cybersecurity requirements ,cybersecurity requirements selected for the pilot program under paragraph 7#a7 shall contain substantially similar or substantially related requirements such that not fewer than #b of the selected cybersecurity requirements govern the same regulated entity with substantially similar or substantially related requirements relating to information security or cybersecurity4 7#e7 ,waivers 7,a7 ,in general ,notwithstanding any provision of subchapter ,,ii of chapter #e1 and chapter #g1 of title #e1 ,united ,states ,code 7commonly known as the ,administrative ,procedure ,act7 and subject to the consent of any participating regulated entity1 in implementing the pilot program under paragraph 7#a71 a regulatory agency participating in the pilot program shall have the authority1 as the regulatory agency determines appropriate1 to both issue waivers and establish alternative procedures for regulated entities participating in the pilot program with respect to the cybersecurity requirements included under the pilot program4 7,b7 ,compliance ,a regulated entity that notifies a regulatory agency of the entity's participation in a pilot program shall be deemed in compliance with the waived requirements to the extent that the entity complies with requirements of the pilot program4 7,c7 ,termination ,waivers issued and alternative procedures established under this paragraph shall terminate on the date on which the pilot program terminates4 7#f7 ,subsequent pilot program ,the ,committee may only authorize an additional pilot program after the later of-- 7,a7 the date of the conclusion of all of the initial pilot programs under paragraph 7#a72 and 7,b7 the date of submission of all reports required under subsection 7i7 for each initial pilot program4 7#g7 ,sunset ,the pilot program shall terminate on the date that is #g years after the date on which the pilot program began under paragraph 7#a74 7g7 ,consultation with the ,committee 7#a7 ,in general ,notwithstanding any other provision of law-- 7,a7 except when an exigent circumstance described in paragraph 7#c7 exists1 before promulgating or amending a cybersecurity requirement1 a regulatory agency shall consult with the ,committee regarding such requirement and the regulatory framework2 7,b7 independent regulatory agencies1 when promulgating or amending a cybersecurity requirement1 shall consult the ,committee during the development of the updated cybersecurity requirement or the new cybersecurity requirement to ensure that the requirement is aligned to the greatest extent possible with the regulatory framework2 and 7,c7 such consultation should be integrated with existing interagency review and input processes administered by the ,office of ,information and ,regulatory ,affairs of the ,office of ,management and ,budget4 7#b7 ,consultation report ,following a consultation under paragraph 7#a71 the ,committee1 in coordination with the ,office of ,management and ,budget as necessary1 shall provide to the agency a report that shall be advisory in nature and shall-- 7,a7 include to what degree the proposed cybersecurity requirement or update to the cybersecurity requirement aligns with the regulatory framework1 taking into consideration the authorities of the agency2 and 7,b7 provide a list of recommendations to improve the cybersecurity requirement and to align the cybersecurity requirement with the regulatory framework4 7#c7 ,exigent circumstances ,in the case of an exigent circumstance where an agency is authorized by law to act expeditiously1 the agency shall notify the ,committee as soon as possible4 7h7 ,consultation with sector risk management agencies ,the ,committee shall consult with appropriate ,sector ,risk ,management ,agencies in the development of the regulatory framework and the implementation of the pilot program under subsection 7f7 and shall consult with members of industry and critical infrastructure1 as appropriate1 for the development of the regulatory framework and pilot program4 7i7 ,reports 7#a7 ,annual report ,not later than #a year after the date of enactment of this ,act1 and annually thereafter until the date on which the pilot program terminates1 the ,committee shall submit to the appropriate congressional committees a report including-- 7,a7 information about member participation in ,committee activities1 including the rationale for any nonparticipation by ,committee members2 7,b7 information about the application of the regulatory framework1 once developed1 on cybersecurity requirements1 including consultations or discussions with regulators2 7,c7 a general summary of reports made under subsection 7g77#b72 and 7,d7 an analysis of the efficiency of the regulatory framework4 7#b7 ,pilot program report ,not later than #a year after the date on which a pilot program under subsection 7f7 begins1 the ,committee shall submit to the appropriate congressional committees a report detailing-- 7,a7 the cybersecurity requirements selected for the program1 including-- 7i7 the reasons that the regulatory agency and cybersecurity requirement were selected2 7ii7 a list of the pilot programs considered by the ,committee2 and 7iii7 the rationale for selecting the pilot program2 7,b7 the information learned from the program2 7,c7 any obstacles encountered during the program2 and 7,d7 an assessment of the applicability of expanding the program to other agencies and cybersecurity requirements4 #d4 ,coordination with ,federal agencies and international bodies 7a7 ,in general ,not later than #ahj days after the date of enactment of this ,act1 the ,director of the ,office of ,management and ,budget shall1 in consultation with the ,committee1 issue guidance to ,federal agencies1 including the ,cyber ,incident ,reporting ,council1 on coordination with the ,committee4 7b7 ,guidance 7#a7 ,in general ,not later than #a year after the completion of the initial pilot program and submission of the pilot program report1 the ,director of the ,office of ,management and ,budget shall1 in coordination with the ,committee1 issue guidance to all agencies to ensure cybersecurity requirements are consistent with the framework developed under subsection 7e71 incorporating the results and lessons learned from the pilot program4 7#b7 ,contents ,the guidance issued under paragraph 7#a7 shall1 at a minimum-- 7,a7 include updates to the regulatory review process1 as appropriate1 for proposed cybersecurity requirements2 7,b7 provide draft regulatory language for covered agencies to use when preparing cybersecurity requirements2 7,c7 provide guidance and procedures for covered agencies to resolve inconsistencies with the framework2 and 7,d7 provide a template for covered agencies on how to use the guidance1 including recommended procedures for implementation4 7c7 ,reporting ,all agencies shall report to appropriate congressional committees on the status of implementing the guidance issued under subsection 7a74 7d7 ,assistance 7#a7 ,foreign entities ,the ,committee1 with the concurrence of the ,secretary of ,state1 and in coordination with the ,national ,institute of ,standards and ,technology1 may provide expertise or technical assistance on harmonization and reciprocity of cyber requirements to a foreign government1 an international organization1 or an international entity1 as appropriate4 7#b7 ,local entities ,the ,committee may provide expertise or technical assistance on harmonization and reciprocity of cyber requirements to ,state1 local1 ,tribal1 and territorial governments1 as appropriate4 #e4 ,rule of construction ,nothing in this ,act shall be construed-- 7#a7 to expand or alter the existing authorities of any agency1 including any independent regulatory agency1 except for exemptions under section #c7;f7 to implement the pilot program established under that section2 7#b7 to provide any such agency any new or additional authorities1 except for exemptions under section #c7;f7 to implement the pilot program established under that section2 or 7#c7 to affect1 augment1 or diminish the authority of the ,secretary of ,state or any other officer of the ,federal ,government4