Key Takeaways
- Three DHS agencies (U.S. Coast Guard, Transportation Security Administration, and Cybersecurity and Infrastructure Security Agency) have issued overlapping but inconsistent cybersecurity rules for critical infrastructure.
- Industry reports indicate that up to half of some firms’ staff time is spent merely managing compliance with these conflicting requirements.
- The July 2025 GAO study found little progress toward regulatory harmonization over the past decade.
- Congress has identified six legislative approaches to resolve the fragmentation, including common definitions, a single harmonization authority, reciprocity, a unified reporting portal, and joint compliance guides.
- Executive action could align the agencies internally, but deregulation mandates and CISA’s resource constraints may impede progress, potentially necessitating legislative intervention.
Why It Matters
The fragmentation of cybersecurity regulations across three separate Department of Homeland Security (DHS) agencies creates a compliance nightmare for operators of critical infrastructure. Companies that operate vessels, pipelines, rail systems, or maritime terminals may find themselves subject to three distinct sets of definitions, reporting timelines, and submission destinations. This regulatory tangle not only raises administrative costs but also risks gaps in incident detection and response, as highlighted by the 2021 Colonial Pipeline ransomware attack that disrupted fuel supplies along the Eastern Seaboard for six days.
The Big Picture
The U.S. Coast Guard (USGC) rule, effective July 16, 2025, applies to U.S.-flagged vessels, Outer Continental Shelf facilities, and sites governed by the Maritime Transportation Security Act of 2002. The Transportation Security Administration (TSA) issued a proposed rule on November 7, 2024 that would cover roughly 293 high‑risk pipeline, freight rail, passenger rail, and bus operators; the rule remains pending finalization. The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), administered by the Cybersecurity and Infrastructure Security Agency (CISA), constitutes the third regulatory regime. While all three require cyber incident reporting, they employ different definitions of what constitutes a reportable event, divergent notification deadlines, and separate reporting channels.
Current State of Fragmentation
Under the USGC rule, incidents must be reported to the National Response Center “without delay.” The TSA proposal calls for a 24‑hour reporting window, and CISA’s CIRCIA framework specifies its own timeline and reporting portal. Entities such as a maritime pipeline terminal could simultaneously fall under all three regimes, forcing them to duplicate efforts, maintain multiple logs, and navigate conflicting definitions of a cyber incident. The exact number of facilities facing these overlapping obligations is unknown, but industry testimony to the Government Accountability Office (GAO) suggests the burden is substantial.
Industry Impact
GAO interviews revealed that some operators allocate as much as 50 percent of their staff’s time to cybersecurity compliance activities alone. One operator summed up the stagnation: “We are no closer today than we were 10 years ago on creating a solution for harmonization.” This diversion of talent from core operational and security functions weakens overall resilience and inflates operating costs, ultimately affecting service reliability and consumer prices.
Potential Solutions Identified by Congress
The Congressional Research Service (CRS) report released in June outlines six legislative pathways to alleviate the fragmentation. First, Congress could mandate common definitions and reporting standards for cyber incidents across all agencies. Second, it could empower a single harmonization authority—such as the Office of the National Cyber Director—with binding cross‑agency authority to enforce consistency. Third, it could require reciprocity, allowing compliance with one agency’s program to satisfy another’s requirements. Fourth, establishing a unified reporting portal would eliminate duplicate submissions. Fifth, directing the three agencies to jointly develop compliance guides for entities under multiple regimes would clarify expectations. Sixth, Congress could codify any of these measures into law to ensure durability beyond administrative shifts.
Constraints on Executive Action
The most direct route to alignment lies within DHS itself: the Secretary could issue a directive compelling the USGC, TSA, and CISA to harmonize their cyber incident reporting definitions, timelines, and destinations without new legislation. However, two significant constraints may hinder this approach. Executive Order 14192, titled “Unleashing Prosperity Through Deregulation,” signed by President Trump in January 2025, mandates broad regulatory reduction across the federal government. It remains uncertain whether this deregulation push will delay or prevent the TSA and CISA from finalizing their proposed cybersecurity rules, potentially leaving the fragmentation intact. Additionally, CISA has faced intensifying workforce and budget constraints since 2025, limiting its capacity to negotiate harmonization agreements or build new reporting infrastructure, even if leadership desires to do so.
Congressional Options If Executive Action Stalls
Should internal DHS efforts falter, Congress may need to intervene legislatively. The CRS report suggests that mandating common definitions, creating a unified reporting authority with binding power, or requiring reciprocity agreements could break the current deadlock. Such measures would reduce the compliance burden on industry—freeing staff to focus on actual security improvements—while strengthening the overall resilience of critical infrastructure sectors. By establishing clear, consistent rules, lawmakers can help ensure that future cyber incidents are detected, reported, and mitigated more swiftly, protecting both the economy and public safety.
Conclusion
The current patchwork of DHS cybersecurity regulations imposes unnecessary costs and operational confusion on critical infrastructure operators. While the Secretary of Homeland Security possesses the authority to align the three agencies internally, deregulation mandates and resource limitations at CISA may impede swift action. Legislative solutions—ranging from standardized definitions to a single harmonization authority—offer a viable path forward if executive initiatives stall. Implementing any of these reforms would streamline compliance, enhance incident response capabilities, and ultimately bolster the security and reliability of the nation’s vital infrastructure.