Loading story…
A Government Accountability Office report to Congress found that federal cybersecurity reporting requirements are heavily fragmented and often duplicative, with 80 of 117 regulations issued by 37 agencies overlapping across nine critical infrastructure sectors. GAO said those rules contain at least 125 reporting requirements, many of which impose the same written reporting obligations on regulated entities or create potentially conflicting demands across sector-specific and cross-sector regimes.
The report said harmonization efforts have made only limited progress despite federal directives assigning the Office of the National Cyber Director a lead role in reducing overlap and compliance burdens. GAO highlighted the impact on critical infrastructure and financial services organizations, which can face multiple incident-reporting and disclosure obligations from different regulators, including possible overlap involving Department of Homeland Security incident-reporting rules, Securities and Exchange Commission cybersecurity disclosure requirements, and pending Cyber Incident Reporting for Critical Infrastructure Act implementation.
See the reporting duties and controls this puts on the clock.
4 events from the most recent confirmed update back to the earliest known activity.
Some federal work to harmonize overlapping cybersecurity reporting requirements was paused after a Trump executive order, pending further review.
A 2024 national security memorandum directed the Office of the National Cyber Director and the Department of Homeland Security to harmonize conflicting federal cybersecurity regulations.
The White House's March 2026 national cyber strategy made harmonizing cybersecurity regulations and reducing compliance burdens a priority, with implementation plans expected to clarify agency roles and next steps.
GAO reported that it reviewed 117 cybersecurity regulations issued by 37 federal agencies and found that 80 contained at least 125 reporting requirements, many of which appear duplicative or potentially conflicting for critical infrastructure entities.
See what this changes for your reporting obligations and which controls it puts on the clock.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Cybersecurity and Infrastructure Security Agency (CISA)** announced it will hold sector-by-sector virtual town halls to gather additional industry feedback on its long-delayed rulemaking under the **Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA)**. The proposed regulation would require covered critical infrastructure entities to report **significant cyber incidents within 72 hours** and **ransomware payments within 24 hours**, but key details—such as which entities are covered, how to treat small businesses, what incident examples trigger reporting, and how to avoid conflicts with existing regulatory regimes—remain contentious and are a focus of the sessions. Separately, CISA leadership briefed staff on an impending **Cybersecurity Division reorganization** driven by resource constraints, including plans to **deprioritize or shut down some programs** to concentrate on higher-profile goals such as **operational technology (OT) security** and core national cyber defense functions. The internal messaging emphasized doing more with fewer personnel following a period of layoffs, retirements, and other disruptions, while refocusing the division on delivering actionable cyber intelligence to partners and coordinating broader “national cybersecurity defense” planning and operations.
Jun 29, 2026
A Government Accountability Office audit found significant weaknesses in how the **Federal Aviation Administration** and **Transportation Security Administration** manage aviation cybersecurity, raising concerns about the resilience of U.S. aviation systems. The FAA had fully implemented only **three of seven** cybersecurity strategy objectives, with gaps in cyber monitoring, incident response, privileged access controls, standards compliance, zero-trust migration planning, and complete reporting of cybersecurity spending. GAO warned that weaknesses such as poor patching and unsupported operating systems could disrupt communications and alter flight data, even though no successful cyberattacks on aircraft avionics have been reported. The audit also found that the TSA is still relying on an outdated **2018 Cybersecurity Roadmap** that does not clearly assign responsibility for securing airlines and airports or align with current Department of Homeland Security strategy, contributing to confusion and weak accountability across the sector. GAO issued **five recommendations** calling on TSA to update and clarify its roadmap and on FAA to improve budget reporting, zero-trust planning, and monitoring of its revised strategy; the review noted that FAA and TSA have cooperated effectively through the **Aviation Cyber Initiative** and that FAA certification and National Airspace System authorization processes generally addressed identified avionics cybersecurity practices.
Jul 21, 2026The U.S. Department of Health and Human Services (HHS) has not implemented 82 high-risk cybersecurity and IT management recommendations from the Government Accountability Office (GAO). These include critical issues such as event logging, digitized record handling, and IoT device inventory. The lack of action increases risks to sensitive health data and national security, according to the GAO report released on September 12, 2025.
Jun 29, 2026