GAO Finds 70% of Federal Cybersecurity Reporting Rules Are Duplicated

Key Takeaways

• A GAO review found that 70 % of federal cyber regulations that require written reports to agencies duplicate existing requirements.
• Of the 117 cyber‑related rules examined across 37 agencies, 80 either repeat the same reporting obligation or cover the same sector as another rule.
• Duplication is especially pronounced in the financial services sector, which may be subject to up to 15 pre‑existing reporting rules plus the pending CIRCIA mandate.
• The Biden administration launched a harmonization effort, continued under the Trump administration, but progress has stalled after an executive order prompted a pause for review.
• Despite a 2024 National Security Memorandum directing the Office of the National Cyber Director and DHS to streamline rules, concrete results remain limited, and congressional interest in further reform persists.

Overview of the GAO Investigation

The Government Accountability Office (GAO) undertook its study at the request of House Homeland Security Chairman Andrew Garbarino (R‑NY) and Senate Homeland Security Committee ranking member Gary Peters (D‑MI). The audit examined cybersecurity regulations that obligate the private sector to submit written reports—such as incident notifications, risk assessments, or recovery plans—to federal agencies. By focusing on 37 agencies and 117 distinct rules, the GAO aimed to quantify how often these obligations overlap or duplicate one another. The findings, released in a report to Congress, highlight a systemic inefficiency that burdens businesses and complicates compliance efforts.

Extent of Duplication Across Federal Rules

According to the GAO, roughly seven out of ten federal cyber regulations that mandate written reporting are duplicated elsewhere in the regulatory landscape. Specifically, 80 of the 117 rules examined either contain the same type of reporting requirement applicable to a particular sector or mirror an identical requirement found in at least one other regulation. This level of redundancy suggests that many agencies are independently crafting overlapping obligations rather than building on existing frameworks. The duplication not only creates unnecessary paperwork for regulated entities but also raises the risk of inconsistent reporting standards and potential gaps in threat visibility.

Sector‑Specific Overlap: Financial Services as a Case Study

The financial services industry exemplifies the problem’s severity. Depending on which federal agency holds oversight—such as the Securities and Exchange Commission, the Federal Reserve, or the Office of the Comptroller of the Currency—a financial institution may already be subject to one of roughly 15 pre‑existing cybersecurity reporting rules. In addition, the pending Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) regulation, being developed by the Cybersecurity and Infrastructure Security Agency (CISA), could impose yet another reporting layer on the same entities. Consequently, a single firm might face multiple, sometimes conflicting, obligations to disclose similar information to different federal bodies, increasing compliance costs and administrative complexity.

Efforts to Harmonize Under the Biden Administration

Recognizing the burden of redundant rules, the Biden administration initiated a more aggressive push to harmonize cybersecurity reporting requirements. This effort built on earlier inter‑agency coordination attempts but sought a more comprehensive alignment of definitions, timelines, and formats across agencies. The goal was to create a unified reporting ecosystem that would reduce duplicative filings while preserving the government’s need for timely threat intelligence. The initiative involved drafting guidance, convening working groups, and exploring legislative options to codify harmonized standards.

Continuation and Subsequent Stalling Under the Trump Administration

The harmonization drive persisted into the early months of the second Trump administration, reflecting bipartisan acknowledgment of the problem. However, momentum waned after President Trump issued an executive order in March of the previous year that mandated a review of the 2024 National Security Memorandum on cybersecurity regulation. The order directed agencies to pause certain harmonization activities while a broader study of the memo’s implications was conducted. As of last month, that study remained underway, effectively freezing many of the ongoing alignment projects and limiting tangible progress toward reducing duplication.

Assessment of Harmonization Progress

In its Wednesday report, the GAO concluded that “many past federal efforts have experienced delays and made limited progress” on harmonizing cybersecurity reporting requirements. Despite the issuance of the 2024 National Security Memorandum—which explicitly tasked the Office of the National Cyber Director and the Department of Homeland Security with streamlining conflicting regulations—concrete outcomes have been scarce. Agencies have made some headway in identifying overlapping rules and sharing best practices, but translating those insights into concrete, enforceable changes has proven challenging. The pause prompted by the Trump executive order further impeded any rapid advancement.

Congressional Interest in Streamlining Regulations

Congress has not remained passive on the issue. Lawmakers from both parties have expressed concern over the regulatory burden placed on critical infrastructure owners and operators. The GAO study itself was commissioned by legislators seeking empirical evidence to inform potential reform. Beyond the GAO’s analysis, other stakeholders—such as the cyber incident response firm BreachRx—have released complementary reports examining how overlapping federal, state, and industry-specific reporting obligations affect real‑world incident response. These external evaluations underscore the practical consequences of duplication and bolster calls for legislative or executive action to create a single, coherent reporting framework.

Implications for the Private Sector

For businesses operating in critical infrastructure sectors, the current landscape means navigating a patchwork of reporting mandates that vary by agency, sector, and even state jurisdiction. This complexity can lead to:

• Increased compliance costs due to the need for separate reporting systems, legal counsel, and internal coordination.
• Risk of inconsistent reporting, where subtle differences in required data elements or timelines may cause confusion or inadvertent non‑compliance.
• Potential gaps in threat intelligence, as agencies may receive fragmented views of the same incident, hindering timely national‑level response.
• Diverted resources from core cybersecurity defenses to administrative tasks, weakening overall resilience.

Addressing these issues through harmonization could free up substantial resources, improve the quality and speed of incident reporting, and strengthen the nation’s cybersecurity posture.

Path Forward

To move beyond the current stalemate, several steps could be considered:

1. Codify a Federal Reporting Standard – Legislation that establishes a uniform set of data elements, timelines, and submission mechanisms for cyber incidents across all federal agencies would eliminate the need for multiple, agency‑specific forms.
2. Leverage Existing Platforms – Expand the use of centralized reporting portals (e.g., CISA’s ICS‑CERT portal) to accept submissions that satisfy multiple agency requirements simultaneously.
3. Institutionalize Inter‑Agency Coordination – Create a permanent working group within the Office of the National Cyber Director tasked with continuously reviewing and aligning reporting rules, with authority to issue binding guidance.
4. Engage Stakeholders Early – Include industry representatives in the rulemaking process to ensure that harmonized requirements are practical, scalable, and aligned with existing best practices.
5. Monitor and Report Progress – Require periodic GAO or Congressional Budget Office reviews to track reduction in duplication and assess impact on compliance burdens and incident response effectiveness.

Implementing such measures would likely satisfy the dual goals of reducing regulatory burden on the private sector while enhancing the federal government’s ability to detect, analyze, and respond to cyber threats in a timely manner. Until then, the landscape of overlapping cyber reporting requirements will remain a significant source of inefficiency for both regulators and the entities they oversee.