Streamlining Federal Cybersecurity Regulations Act

This bill establishes an interagency committee to harmonize federal cybersecurity regulations across different agencies, aiming to reduce inconsistencies and burdens. It defines key terms like 'cybersecurity requirement' and 'harmonization' as aligning rules into common minimum standards and sector-specific ones. The bill also requires status updates on incident reporting agreements and a yearly briefing on the Cyber Incident Reporting Council.

Sec. 2, Definitions: Defines terms used in the bill, including 'agency', 'cybersecurity requirement' (safeguards related to information security), 'harmonization' (aligning requirements into common minimum and sector-specific rules), 'reciprocity' (one agency accepting another's compliance findings), and 'regulatory agency' (any agency with authority to issue cybersecurity requirements).

Sec. 3, Establishment of Interagency Committee: Creates the Harmonization Committee, chaired by the National Cyber Director, composed of heads of regulatory agencies and others. The Committee must develop a regulatory framework for harmonization within one year, including processes for reciprocal compliance and identifying burdensome requirements. It must run a pilot program with at least three agencies and three cybersecurity requirements, allowing waivers for participants. Agencies must consult the Committee before issuing new cybersecurity requirements, except in emergencies. The Committee must report annually to Congress on its activities and on pilot programs.

Sec. 4, Status Updates on Incident Reporting: Requires the Director of CISA to provide status updates every 180 days on agreements between agencies for cyber incident reporting, until one year after a final rule is published. It also amends the Homeland Security Act to require the Secretary to brief Congress yearly on the Cyber Incident Reporting Council's activities for up to seven years.

Sec. 5, Rule of Construction: States that the bill does not expand or alter existing agency authorities, except for the pilot program waivers, and does not grant any new regulatory authority.