GAO Finds Overlap in Federal Cybersecurity Reporting Rules

A new federal watchdog review says companies supporting critical infrastructure may face overlapping cybersecurity reporting requirements from multiple agencies, creating different deadlines, thresholds and definitions for similar incidents.

The Government Accountability Office published its findings on July 22, 2026, after reviewing federal regulations in the Electronic Code of Federal Regulations. GAO identified 117 cybersecurity regulations issued by 37 federal agencies for private entities across nine critical-infrastructure sectors.

Of those 117 regulations, 80 — about 70 percent — contained at least one reporting requirement that was potentially duplicative of a requirement in another regulation. Together, those 80 regulations included at least 125 reporting requirements, with some rules containing more than one type of reporting obligation.

Why the overlap matters

The findings do not mean all 80 regulations are legally duplicative, invalid or unnecessary. GAO described the potential for overlap or conflict, particularly when companies must determine whether an incident meets different reporting thresholds or whether separate agencies require similar information on different schedules.

For businesses responsible for systems used in banking, transportation, communications, health care, energy and other essential services, that can mean additional compliance work during an already difficult cyber incident. Industry representatives told GAO that differences in definitions, reporting details and short deadlines can create redundant work and make it harder to focus on containing an attack.

The public generally is not directly required to file these reports. The obligations primarily affect regulated private entities, but those entities operate systems and services that households, employers and governments rely on every day.

Examples include proposed and existing rules

GAO pointed to a proposed Department of Homeland Security rule for cyber-incident reporting by critical-infrastructure sectors. The proposal could potentially overlap with existing financial-sector regulations that also require incident reporting.

GAO also cited Securities and Exchange Commission requirements that apply across industries. Those cross-sector rules may duplicate or conflict with cybersecurity requirements aimed at particular sectors, depending on the company and the systems involved.

These examples describe possible interactions between rules, not a final determination that every requirement conflicts. The DHS measure remains a proposal, and future agency action could change its scope or reporting standards.

What the administration says it will do

The White House’s March 6, 2026 cyber strategy identified coordination and regulatory streamlining as administration priorities. It said the administration intends to issue an implementation plan to guide follow-up action.

GAO said the Office of the National Cyber Director is responsible for coordinating federal efforts to harmonize cybersecurity standards and regulations under federal law and National Security Memorandum-22. The watchdog said agencies have taken steps toward harmonization, but progress has been limited.

The July 22 GAO review does not identify a completed implementation plan. That leaves the next phase dependent on federal coordination, proposed rules, final rules and agency guidance explaining which entities must report, what information must be submitted and when.

For the public, the central issue is not whether cybersecurity protections should disappear. It is whether agencies can reduce conflicting paperwork and clarify responsibilities without creating gaps in the reporting of attacks that threaten essential services.

Sources

• GAO report GAO-26-108606
• White House cyber strategy