House Oversight and Accountability Hearing on Cybersecurity and Regulations

Summary

The hearing focused on the urgent need to harmonize cybersecurity regulations across U.S. industries to mitigate the growing threats to critical infrastructure. Witnesses from IT, natural gas, banking, and MITRE Corporation emphasized the inefficiencies and high costs of current overlapping and inconsistent regulatory requirements. They advocated for centralized leadership, a common taxonomy, standardized processes, and reciprocity in regulations to improve security outcomes and reduce the burden on businesses, especially smaller entities, while ensuring national and economic security.

Takeaways

• 🔒 Cyber attacks on critical infrastructure are increasing, posing significant threats to national and homeland security.
• 🏢 Much of the critical infrastructure is owned and operated by the private sector, highlighting the need for strong public-private partnerships in cybersecurity.
• 📋 Federal regulations aimed at mitigating cybersecurity risks often result in overlapping and inconsistent requirements, creating inefficiencies and high compliance costs.
• 💼 Companies are forced to divert resources from cybersecurity enhancements to meet various compliance requirements, which can reduce their competitiveness.
• 🔄 The complexity of regulations can be overwhelming for businesses, especially when multiple agencies issue rules on the same topic, leading to confusion and inefficiency.
• 📚 The Office of the National Cyber Director (ONCD) has recognized the need for regulatory harmonization and has sought input from critical sector operators to identify conflicting regulations.
• 🌐 State-level and international cybersecurity regulations further contribute to the regulatory burden, complicating the compliance landscape for companies.
• 🤝 Harmonization and reciprocity in cybersecurity regulations are essential to reduce the burden on industry and improve overall cybersecurity outcomes.
• 🏦 The financial sector, like other critical industries, spends a significant amount of time and resources on regulatory compliance, detracting from efforts to enhance cybersecurity postures.
• 📉 The excessive focus on compliance can lead to reduced morale and staff burnout, as cybersecurity personnel struggle to balance day-to-day security responsibilities with regulatory demands.

Q & A

What is the primary concern addressed in the hearing regarding cyber attacks?

The primary concern is the increasing frequency and scale of malicious cyber attacks on the nation's critical infrastructure, which can create damaging disruptions and compromise highly sensitive data, threatening homeland and national security.

Why is there a need for a strong partnership between the government and private operators of critical infrastructure?

A strong partnership is needed to effectively mitigate cyber security risks and enhance the protection of critical infrastructure, which is often owned and operated by the private sector.

What issues do Federal Regulations intended to mitigate cyber security risk create for key industry participants?

These regulations often subject key industry participants to overlapping and inconsistent requirements, creating an inefficient regulatory regime with high compliance costs, forcing companies to divert resources away from cyber security enhancements.

What is the impact of multiple agencies issuing rules on the same topic?

When multiple agencies issue rules on the same topic, it can lead to an uncontrolled proliferation of regulations, causing confusion and increased administrative burdens for companies that have to comply with these overlapping and inconsistent cyber security rules.

What is the goal of harmonization in cyber security regulations?

The goal of harmonization is to achieve reciprocity in regulations, ensuring that if one regulator finds a company's cyber security measures adequate, other regulators can accept that finding instead of requiring their own independent assessment.

What is the role of the Executive Office of the President in harmonizing cyber security regulations?

Strong centralized leadership from the Executive Office of the President is required to harmonize cyber security regulations and to check regulators within the bureaucracy who may not be considering the broader impact of the rules they issue.

What was the response to the Request for Information (RFI) regarding conflicting cyber security regulations?

The RFI received more than 100 responses describing a highly inefficient regulatory regime that detracts from cyber security outcomes by unnecessarily consuming scarce resources.

How do state level and international cyber security regulations contribute to the regulatory challenges?

State level and international cyber security regulations add further layers to the regulatory morass, complicating the compliance process for companies that must navigate a complex web of different requirements.

What is the average annual cost of cyber crime worldwide expected to reach by 2027?

The average annual cost of cyber crime worldwide is expected to reach $23 trillion by 2027.

What is the role of the Cyber incident reporting Council (CIRC)?

The CIRC was established to study and make recommendations to address conflicting and duplicative federal incident reporting requirements.

What are the three main considerations for harmonizing cyber security regulations according to the oil and natural gas industry?

The three main considerations are robust consultation with the regulated community and other agencies, retroactive harmonization of requirements when possible, and the potential role of a single entity like CISA to facilitate harmonization.

What is the Banking Policy Institute's view on the impact of regulatory compliance on cyber security personnel?

The Banking Policy Institute believes that the focus on regulatory compliance activities leaves less time for risk mitigation and strategic security initiatives, which could be better spent on fortifying firm defenses.

What is the significance of harmonization and reciprocity in the context of cyber security regulations?

Harmonization refers to the alignment of agencies and related regulations on a common set of requirements for a desired security outcome, while reciprocity means that the findings of one regulator satisfy the requirements of another, reducing redundant compliance costs on industry.

What is the role of the National Cyber Director (NCD) in addressing the issue of cyber security regulatory harmonization?

The NCD is responsible for implementing an actionable plan to harmonize existing cyber regulations, holding federal agencies accountable, and developing a structured reciprocity process anchored in baseline controls and standards across federal government regulations.

What is the recommendation for a single clearing house for cyber incident reporting?

The recommendation is to implement a single clearing house for reporting cyber incidents, which could be operated within a federal agency like CISA or by an independent third party, to streamline reporting and coordination across agencies.

What is the current state of harmonization in the IT sector according to Mr. Miller's testimony?

According to Mr. Miller, despite long-standing consensus on the need for harmonization, there has not been a single conflicting, inconsistent, or duplicative cyber regulation eliminated or streamlined, indicating a need for action.

What is the impact of regulatory compliance on smaller companies in the tech sector?

Smaller companies in the tech sector are disproportionately affected by conflicting regulatory requirements, as it is more of a zero-sum game for them, with higher costs and potential inability to figure out what regulations they need to comply with.

What are the challenges faced by the banking sector in terms of cyber incident reporting?

The banking sector faces challenges with cyber incident reporting due to different definitions, time frames, and information requirements across various regulators, which results in a significant strain on personnel and resources.

What is the role of the Cybersecurity and Infrastructure Security Agency (CISA) in harmonizing cyber security regulations?

CISA has been tasked with harmonizing cyber security regulations under the Cybersecurity Incident Reporting for Critical Infrastructure Act (CERSA), and is expected to leverage existing requirements and streamline the process.

What is the potential solution proposed by Dr. Clancy for improving the harmonization of cyber security regulations?

Dr. Clancy proposes moving from study to action, building on existing initiatives like CERSA, and establishing a clearing house for cyber incident reporting that coordinates across the interagency.

What is the impact of regulatory compliance on the morale and staff burnout in the banking sector?

Regulatory compliance has led to staff working exceedingly long hours to balance their obligations, resulting in decreased morale and staff burnout, which can affect the overall effectiveness of cyber security efforts.

How do industry standards and government regulations differ in their impact on a company's approach to cyber security?

Industry standards and government regulations both play a role in a company's cyber security approach, but when regulations are aligned with industry standards and developed through consultative processes with the industry, they can be more effective and less burdensome.