Streamlining Federal Cybersecurity Regulations Act

This bill establishes an interagency Harmonization Committee to align federal cybersecurity regulations across different agencies, aiming to reduce conflicting or duplicative requirements for regulated entities. It also requires status updates on incident reporting agreements and a yearly briefing on the Cyber Incident Reporting Council's activities.

Sec. 2, Definitions: Defines key terms used in the bill, including 'cybersecurity requirement' as any safeguard or rule related to information security or cyber risk, 'harmonization' as aligning requirements into common minimum standards plus sector-specific ones, 'reciprocity' as one agency accepting another's compliance findings, and 'regulatory agency' as any agency with authority to issue or enforce mandatory cybersecurity requirements.

Sec. 3, Establishment of interagency committee to harmonize regulatory regimes: Creates the Harmonization Committee, chaired by the National Cyber Director, composed of heads of regulatory agencies and other officials. The Committee must develop a regulatory framework within one year to achieve harmonization, including processes for reciprocal compliance, identifying burdensome requirements, and recommending updates. At least three regulatory agencies will run a pilot program testing the framework on at least three cybersecurity requirements. Before issuing new cybersecurity requirements, agencies must consult the Committee, except in exigent circumstances. The Committee must consult Sector Risk Management Agencies and industry stakeholders, and submit annual reports and pilot program reports to Congress.

Sec. 4, Status updates on incident reporting: Requires the Director of CISA to provide Congress with status updates every 180 days on the development of documented agreements between agencies under the Cyber Incident Reporting for Critical Infrastructure Act. It also amends the Homeland Security Act to require the Secretary to brief Congress annually on the activities of the Cyber Incident Reporting Council.

Sec. 5, Rule of construction: States that nothing in the bill expands or alters existing regulatory authorities of any agency, except for the waiver authority granted to implement the pilot program, and does not provide any new regulatory authorities.