House Homeland Security hearing urges CISA and other agencies to revise cyber incident reporting rule and harmonize regulations

The House Committee on Homeland Security’s subcommittee on cybersecurity and infrastructure protection opened a hearing to examine federal cyber regulatory fragmentation and the implementation of the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCEA or CERCEA). Chairman Garberino said the panel’s purpose was “to evaluate the effectiveness of the federal cyber regulatory regime and to identify opportunities to harmonize cyber regulations across the federal government.”

The committee pressed CISA and other regulators to revise the agency’s proposed CIRCEA rule, arguing the draft is too broad, risks overwhelming CISA with low‑value reports and could divert industry resources away from incident response. The subcommittee’s ranking member, Representative Eric Swalwell, said the proposed rule had not sufficiently incorporated private‑sector feedback and urged CISA to reengage stakeholders before issuing a final regulation.

Why it matters: witnesses and members said duplicative reporting requirements across dozens of federal agencies are taxing security teams and reducing time spent on remediation. Heather Hogshead, senior vice president and deputy head of BITS at the Bank Policy Institute, told the subcommittee that banks’ security teams can spend “30 to 50% of their time on…