Cybersecurity Regulations: Industry Perspectives on the Impact, Progress, Challenges, and Opportunities of Harmonization , July 30 , 2025
Cybersecurity Regulations: Industry Perspectives on the Impact, Progress, Challenges, and Opportunities of Harmonization , July 30 , 2025
From the report: “Our nation increasingly depends on computer-based information systems and electronic data to execute fundamental operations and to process, maintain, and report crucial information. Further, nearly all federal and nonfederal operations, including the nation’s critical infrastructure, are supported by these systems and data. Consequently, the safety of these systems and data is critical to public confidence and the nation’s security, economy, and welfare.
GAO has identified cybersecurity as a government-wide high-risk area for more than 25 years. Recognizing a growing threat, we first designated information security as a government-wide high-risk area in 1997. Subsequently in 2003, we expanded the information security high-risk area to include the cybersecurity of critical infrastructure. We further expanded this high-risk area in 2015 to include protecting the privacy of personally identifiable information. In our most recent update on this high-risk area in February 2025, we reiterated that fully establishing and implementing a national cybersecurity strategy was needed to protect the nation’s information systems and infrastructure.
We have also issued numerous reports that identified concerns around varying federal cybersecurity requirements, often rooted in regulation, and the implementation of those requirements. For example, in May 2020 we identified adverse impacts that varying cybersecurity requirements issued by four selected federal agencies had on state government agencies. Further, in July 2024, we reported on the Department of Homeland Security’s efforts to implement federal cyber incident reporting requirements and challenges with harmonizing these requirements.3 Those challenges included differences in the (1) definitions of reportable cyber incidents, (2) timelines and triggers for when reports must be made, (3) contents of cyber incident reports, and (4) how the reports are submitted to federal agencies.”
Authors - Government Accountability Office (GAO)Related Resources
