The Government Accountability Office has put a number on a complaint contractors have voiced for years: federal cybersecurity reporting rules pile on top of each other. In GAO-26-108606, "Cybersecurity Regulations: Multiple Sectors Are Subject to Potentially Duplicative Reporting Requirements," released July 22, 2026, auditors identified 117 cybersecurity regulations established by 37 federal agencies for private entities across nine critical infrastructure sectors — and found that 80 of them, about 70 percent, carried at least 125 total reporting requirements that were potentially duplicative.

Background

Cybersecurity reporting obligations did not arrive through a single statute or a single rulemaking. They accumulated. Sector regulators wrote incident-reporting rules for the entities they oversee, the Securities and Exchange Commission wrote a disclosure requirement for publicly traded companies, and the Cybersecurity and Infrastructure Security Agency has an incident-reporting rule pending under the 2022 Cyber Incident Reporting for Critical Infrastructure Act. Each rule made sense to the agency writing it. Read together, they produce a compliance map that no single company office can hold in its head.

Congress has noticed. GAO conducted the study at the request of House Homeland Security Committee Chairman Andrew Garbarino (R-NY) and Sen. Gary Peters (D-Mich.), the top Democrat on the Senate counterpart committee, according to CyberScoop. Both have pressed for harmonization — the idea that one incident should trigger one report, or at least a common set of data fields satisfying multiple regulators at once.

The executive branch has an owner for that job. A 2024 national security memorandum tasked the Office of the National Cyber Director, alongside the Department of Homeland Security, with harmonizing cyber regulation. GAO's assessment of the results is blunt: ONCD and other federal agencies "have initiated actions in recent years to harmonize cybersecurity regulations but have made limited progress," and "many past federal efforts have experienced delays and made limited progress." CyberScoop reports the executive branch paused some of that work after President Trump issued an executive order in March of last year, while the administration studied the 2024 memo — a study still underway as of last month. GAO notes that in March 2026 the White House issued a new national cyber strategy establishing harmonization and reducing compliance burdens as a priority, with implementation plans intended to follow that "could help identify clear lead agency roles, responsibilities, and next steps."

Key Details

The scope of the count matters. GAO looked at regulations imposed on private entities — not internal federal agency requirements — across nine critical infrastructure sectors, and traced them back to 37 separate rulemaking agencies. That breadth is the finding: cybersecurity regulation in the United States is not one program with one regulator, but dozens of programs written by agencies whose primary missions lie elsewhere.

Within the 80 regulations flagged as potentially duplicative, GAO counted at least 125 separate reporting requirements — some individual regulations carry more than one obligation, which is how the requirement count exceeds the regulation count. The duplication runs in two directions. Horizontally, multiple regulations covering the same sector demand the same kind of report. Vertically, cross-sector rules stack on top of sector-specific ones.

The proposed CIRCIA rule is GAO's clearest illustration of the vertical problem. In the proposal itself, the department acknowledged potential overlap with 15 existing financial-sector regulations that already require similar incident reporting. A covered financial services entity, in other words, could face 15 preexisting reporting rules and then a sixteenth obligation layered over the top once CIRCIA takes effect. The pending rule, which CISA is writing, would require critical infrastructure owners and operators to report major attacks and ransomware payments.

Advertisement

The SEC's cybersecurity disclosure requirement for publicly traded companies creates a second kind of friction. GAO found it may "duplicate or conflict with regulations focused on a specific sector." Conflict is the harder problem: duplicative rules cost time and headcount, while conflicting rules force a company to choose which regulator to satisfy on timing, materiality, or what gets disclosed publicly while an investigation is still open.

GAO's framing throughout is "potentially duplicative" rather than definitively redundant, because whether two requirements truly overlap depends on definitions — what counts as an incident, what triggers the clock, what data fields a report must carry. That ambiguity is itself part of the burden: a company that cannot tell whether two rules are the same rule must comply with both.

What It Means for Contractors

Federal contractors sit at the intersection of these stacks rather than outside them. A defense contractor operating under DFARS 252.204-7012 must "rapidly report" cyber incidents to the Department of Defense — defined in the clause as within 72 hours of discovery — and must meet the security requirements in NIST Special Publication 800-171 on covered contractor information systems. If that same contractor also operates in a regulated sector — a bank subsidiary, a hospital system, a utility, a publicly traded parent — it inherits that sector's reporting rules too, plus CIRCIA when it lands. GAO's count is the first quantified picture of how deep that stack goes.

Three practical takeaways follow. First, build the reporting matrix now rather than during an incident. The companies that handle a breach cleanly are the ones that already know, in writing, which regulators must be notified, on what clock, and by whom. GAO's finding that 80 regulations carry at least 125 reporting requirements is a warning that this mapping exercise is bigger than most compliance teams assume — particularly where a 72-hour DoD clock runs concurrently with a sector regulator's own deadline.

Second, treat harmonization as a planning assumption, not a near-term deliverable. GAO says progress has been limited and that past efforts have repeatedly stalled. The March 2026 national cyber strategy promises implementation plans that could clarify lead-agency roles, but no rule has been withdrawn or consolidated on the strength of that promise, and the study prompted by last year's executive order was still running as of last month. Contractors budgeting compliance headcount for the next two fiscal years should assume the current stack persists.

Third, use the report in comment letters and pricing. When agencies open comment periods on new cyber reporting rules — CIRCIA implementation among them — GAO-26-108606 supplies a documented federal finding that the existing baseline is already redundant. That is stronger footing than an assertion of burden, and it applies equally to indirect-cost negotiations where compliance overhead has to be justified to a contracting officer.

The report's underlying message for the contracting community is that duplication is now an audited fact, not a trade-association talking point. Whether ONCD converts that finding into fewer reports is the open question. Plan for the 125 requirements that exist today; treat any reduction as upside.

Sources