GAO Confirms Cyber Reporting Burdens As CIRCIA Rules Loom

The Government Accountability Office (GAO) released on July 22 a comprehensive assessment of federal cybersecurity requirements, and its conclusion will sound familiar to many regulated companies: overlapping requirements are widespread, reporting obligations are duplicative, and harmonization efforts have not worked.

In its report, Cybersecurity Regulations: Multiple Sectors Are Subject to Potentially Duplicative Reporting Requirements (GAO-26-108606), GAO examined cybersecurity regulations affecting private sector entities across critical infrastructure and found a substantial amount of potential for duplication and conflict across the federal government. The report arrives at a particularly apt time, as the Cybersecurity and Infrastructure Security Agency (CISA) moves toward finalizing new reporting regulations under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA).

GAO Finds Substantial Regulatory Overlap

GAO identified a whopping 117 existing cybersecurity regulations administered by 37 federal agencies across nine critical infrastructure sectors. Of those, it found that 80 regulations (about 70%) have affirmative reporting requirements, collectively imposing at least 125 separate reporting obligations on private sector entities. These obligations include cyber incident reporting, submission of cybersecurity plans and technical information, and reporting related to audits, reviews, and assessments.

The report found that many regulations require regulated entities to provide similar information to different federal agencies, such that companies may need to prepare multiple reports concerning the same cybersecurity event or compliance activity. GAO highlighted potential overlap across all three reporting categories, including 48 regulations requiring cyber incident reporting, 52 requiring cybersecurity plans or technical information, and 25 requiring audits, reviews, or assessments. (And this does not even touch on state obligations, which are proliferating).

This figure from the GAO report shows the number and nature of the requirements:

GAO's findings reinforce concerns that industry and cyberattack victims have raised for years. As Wiley previously observed, companies operating in critical infrastructure sectors often must navigate a “maze of duplicative, inconsistent, and fragmented cybersecurity regulations” imposed by multiple regulators. This was the finding reached years ago by the Cyber Incident Reporting Council in its 2023 report, Harmonization of Cyber Incident Reporting to the Federal Government, that found dozens of overlapping reporting obligations and observed “significant variation in the maturity and degree of deconfliction of existing cyber incident reporting requirements within and across the 16 critical infrastructure sectors.” Industry has been clamoring for relief for quite some time, across government.

The Obligations Divert Resources from Security to Compliance

The report underscores the practical burdens these requirements place on regulated entities. Informed by industry engagement, GAO noted that stakeholders frequently view cyber incident reporting obligations as duplicative and inconsistent. Participants told GAO about difficulties gathering and submitting information to multiple agencies within short reporting timeframes and expressed concern that duplicative reporting compliance efforts can consume resources that would instead be devoted to incident response and cybersecurity improvements.

This observation is notable, even if it is not surprising. Stakeholders documented similar concerns in comments filed on the Office of the National Cyber Director (ONCD) 2023 regulatory harmonization request for information.

CIRCIA Is Likely to Add a New Layer of Reporting

Despite the clear problem of overlapping reporting obligations, critical infrastructure owners and operators should prepare for yet more reporting. The report acknowledges that the forthcoming CIRCIA rules will add to the mix. GAO notes that Congress enacted CIRCIA in part to improve federal visibility into significant cyber incidents affecting critical infrastructure, but it did not mandate the removal or reduction of regulations. 

GAO highlighted the financial services sector, where entities are already subject to cybersecurity incident reporting obligations administered by the Securities and Exchange Commission, Federal Reserve, the Office of the Comptroller of the Currency, Federal Deposit Insurance Corporation, National Credit Union Administration, Department of the Treasury, Federal Trade Commission, and Commodity Futures Trading Commission. Once CIRCIA is finalized, many of those same organizations could also be required to report incidents to CISA. The report further notes that differences in definitions, reporting thresholds, triggers, timelines, and required content could require entities to prepare multiple reports about the same incident for different federal recipients. These concerns are not unique to the financial services sector. Several sectors, including communications and transportation, also have myriad overlapping obligations.

Industry has been calling for relief. Earlier this year, Wiley’s cyber team noted that commenters on the CIRCIA rules expressed significant concerns about the proposed rule's lack of harmonization with existing cybersecurity reporting obligations, as well as the potential scope and burden of the reporting framework.

Although federal policymakers have repeatedly recognized the importance of harmonization, GAO concluded that progress has been limited. The report notes delays, pauses, and inactivity across several initiatives intended to align cybersecurity reporting requirements and reduce duplicative obligations. For example, GAO found that recommendations from the Cyber Incident Reporting Council's 2023 harmonization effort have not been fully implemented, and the interagency Cybersecurity Forum for Independent and Executive Branch Regulators, tasked with harmonization between agencies, has not been active since late 2024. GAO calls on the ONCD and “other involved agencies to prioritize and follow-through on previously initiated efforts to harmonize cybersecurity regulations.”

Looking Ahead

Organizations should already have mapped their existing reporting obligations as part of their preparation for cyber incidents. The GAO report is a helpful compendium against which to check existing mappings, but otherwise paints a stark picture of a federal cyber regulatory landscape that is expanding in scope and complexity. And while GAO's report underscores the need for CISA and other agencies to look carefully at their existing requirements, organizations should brace for additional reporting obligations when the CIRCIA rules are finalized.