Streamlining Federal Cybersecurity Regulations Act of 2025
The Streamlining Federal Cybersecurity Regulations Act of 2025 would create a new interagency Harmonization Committee, chaired by the National Cyber Director, to align and streamline federal cybersecurity rules across agencies. The bill envisions a two-part approach: (1) establish a regulatory framework with a common baseline of cybersecurity requirements plus sector-specific rules aligned to risk and international standards; and (2) run limited pilots (3–5 agencies, 3–6 requirements) to test how the framework can work in practice, including temporary waivers for pilot participants. Public input, interagency consultation, and transparency with Congress and industry are emphasized. The act also requires a formal regulatory framework publication, ongoing guidance to agencies, annual reporting, and coordination with sector risk management agencies and international/local entities. A pilot program would run for up to 7 years and would sunset thereafter, with potential expansion only after completing initial pilots and required reporting. In short, the bill aims to reduce regulatory fragmentation in federal cybersecurity by creating a centralized framework and phased, monitored pilots to harmonize requirements across agencies while preserving appropriate sector-specific protections.
Key Points
- 1Establishment of the Harmonization Committee. The National Cyber Director creates and chairs a committee that includes agency heads (including CISA and NIST), OMB’s regulatory affairs head, and other appropriate agencies to harmonize cybersecurity requirements and promote reciprocity across sectors.
- 2Regulatory framework with baseline and sector-specific requirements. Within one year of enactment, the Committee must develop a framework that sets a common minimum baseline for all sectors and allows sector-specific requirements that address unique risks, while ensuring alignment with existing processes and laws.
- 3Public involvement and transparency. The framework development must include public comment and consultation with industry experts and stakeholders; the framework published in the Federal Register; and a publicly accessible list of committee members and participating agencies.
- 4Pilot program (testing the framework). Not sooner than 90 days after framework publication, 3–5 agencies will pilot the framework on 3–6 cybersecurity requirements (at least one from each participating agency). The program allows waivers and alternate procedures during pilots, with compliance still recognized for pilot-oversight purposes; pilots must terminate within seven years and can be followed by additional pilots only after completing initial ones and required reports.
- 5Reciprocity and mechanisms to fix issues. The framework must include reciprocal compliance among agencies for shared minimum requirements and provide processes to identify and address overly burdensome, inconsistent, or contradictory requirements, with updates to regulations and language as needed.
- 6Consultation and reporting. Agencies must consult with the Harmonization Committee before promulgating or amending cybersecurity requirements (except in exigent circumstances). The Committee will issue advisory reports on alignment and recommendations. The Act also requires annual congressional reporting on participation, framework application, pilot results, and framework efficiency, plus a separate pilot-program report within one year of start.
- 7Guidance and coordination with federal and international bodies. After the initial pilot, OMB, in coordination with the Committee, will issue guidance to ensure consistency with the framework, including model regulatory language, templates for implementation, and procedures to resolve conflicts. The Act also contemplates expert assistance to foreign governments or entities and to state, local, tribal, and territorial governments.