Federal Cybersecurity Regulations Seen as Overlapping, Costly by Industry Leaders

According to a newly released report from the U.S. Government Accountability Office (GAO), industry representatives are raising concerns that current federal cybersecurity regulations are overly complex, duplicative, and burdensome, particularly for companies operating across multiple sectors and jurisdictions. While federal efforts to harmonize cybersecurity requirements are underway, progress remains limited, and the lack of standardization continues to create challenges for businesses that support the nation’s critical infrastructure.

The report summarizes feedback gathered in May 2025 from two industry panels consisting of twelve representatives across critical infrastructure sectors such as health care, energy, and transportation. Panelists acknowledged that federal regulations have prompted meaningful investments in cybersecurity and commended initiatives like the Cybersecurity Information Sharing Act for improving cross-sector collaboration. However, participants also cited issues with the sheer number of regulatory requirements, conflicting definitions, and audit redundancies that can divert resources from actual security improvements.

Multiple federal agencies often regulate the same sectors, leading to inconsistencies and repeated requests for the same compliance documentation. Some companies reportedly face up to seven separate audits requiring identical information. Moreover, sector-specific differences are often overlooked in federal definitions and requirements, complicating compliance efforts for organizations with international operations due to misalignments between U.S. and foreign regulations.

Industry voices also stressed that harmonization efforts have not advanced significantly, noting gaps in regulatory coordination and agency understanding of sector-specific risks. Despite these challenges, participants identified potential near-term steps to streamline requirements, such as expanding the use of guidance from the National Institute of Standards and Technology and aligning forthcoming federal cyber incident reporting rules. In the long term, stakeholders suggested that designating a single federal authority to oversee cybersecurity regulation across agencies could improve clarity and reduce redundancy.

The GAO highlighted these industry perspectives as part of its ongoing focus on cybersecurity, which it designates as a high-risk area requiring national strategic action. As critical infrastructure remains a prime target for cyber threats, the call for a more unified and efficient regulatory environment is likely to intensify, particularly under the current federal administration.

Article by multiple contributors, based upon information from a GAO press release

---