Feds seek help on harmonizing cyber regulations
guvendemir/GettyImages/
The White House issued a request for information last month, having previously called for more alignment between various levels of government in its National Cybersecurity Strategy.
When asked what most state CIOs consider to be a top priority of their job, 69% of survey respondents said it was to “ensure IT systems comply with security and regulatory requirements.” In the same survey of state CIOs four years earlier, 70% pegged that as one of the top priorities. That the percentage is roughly the same reflects a long-held frustration of state and local officials with the amount of time spent on federal regulatory compliance.
States and localities, along with the National Association of State Chief Information Officers, argue that it can be costly and time-consuming for industries, businesses and government departments to comply with a patchwork of regulations issued by different federal agencies. For years, these stakeholders have called for more harmonization and coherence between federal, state and local cybersecurity regulations.
It appears that the Biden administration has heard these calls. Last month, the White House issued a request for information from critical infrastructure operators, including state and local governments, on “opportunities for and obstacles to harmonizing cybersecurity regulations.”
Earlier this spring, the administration also issued its National Cybersecurity Strategy, which called for “establishing cybersecurity regulations to secure critical infrastructure where existing measures are insufficient, harmonizing and streamlining new and existing regulations, and enabling regulated entities to afford to achieve security.”
Respondents to the request from the Office of the National Cyber Director, or ONCD, are asked to provide examples of any “conflicting, mutually exclusive, or inconsistent federal and [state, local and tribal] regulations affecting cybersecurity,” whether that guidance has been updated to reflect new cyber threats, how regulated entities comply, the cost of that compliance both financially and in staff time, and whether any prohibitive costs lead to “meaningful security gaps.”
It asks if existing frameworks and interagency guidelines, like those for the financial sector, are effective at providing harmonized requirements, and if there are any governmental or third-party standards in their industry, how they work and if they can be aligned.
And respondents are invited to discuss whether tiered regulation could be applied, if they have examples of cybersecurity oversight by multiple regulators of the same entity, and if such reciprocal arrangements are effective.
ONCD is also seeking insight on state, local, tribal and territorial regulations that critical infrastructure owners and operators are subject to, including whether those regulations are harmonized across states, if there are examples of reciprocity with the federal government, if there are models for harmonization, and any instances where regulatory requirements are “conflicting, mutually exclusive or inconsistent within one jurisdiction.”
Beyond U.S. borders, the office is looking for information about any international regulations where there are conflicts or opportunities for reciprocity, and any groups involved in harmonization. The World Economic Forum, for example, has called for global harmonization of cybersecurity, including in the areas of data protection, innovation and interoperability and cost.
Under the current system, according to the World Economic Forum, “companies must juggle a variety of competing laws across jurisdictions,” while there are “conflicting definitions” of what constitutes a cyber incident.
In a blog post on the request for information, global law firm Mayer Brown said the use of the word “harmonization” could be the ONCD suggesting that it may use this process “to detect potential elements of an overarching, broadly applicable baseline cybersecurity regulation that does not currently exist in the United States.
“In this way, while presenting an opportunity to reduce undue regulatory burden, the RFI may prove to be a step toward filling gaps in cybersecurity regulation that the administration identifies,” the post continued.
In an email, Alex Whitaker, NASCIO’s director of government affairs, said the organization “applauds” the ONCD’s request. “State chief information officers have long advocated for harmonization of federal cyber regulations that are duplicative, costly and impediments to implementing the ‘whole of state’ cybersecurity strategies that are most vital for effective digital governance,” he said.
Comments are due in writing by Sept. 15.
NEXT STORY: Cyber grant program gets a big funding boost