Most federal cybersecurity reporting rules are duplicative, study finds

The Government Accountability Office found widespread duplication among federal cybersecurity reporting rules—80 of 117 requirements overlap—creating compliance complexity for critical infrastructure and sectors such as financial services. Efforts to harmonize rules (including work under CISA's CIRCIA and a 2024 national security memorandum) have seen limited progress and were partially paused following an executive order, highlighting ongoing regulatory fragmentation rather than any technical cyber incident.