Washington, D.C. – Heather Hogsett, Senior Vice President and Deputy Head of BITS — the technology policy division of BPI — will testify today before the U.S. House Homeland Security Subcommittee on Cybersecurity and Infrastructure Protection. Hogsett’s testimony addresses the urgent need to reduce duplicative and conflicting cyber regulatory requirements.
“The current patchwork of duplicative cybersecurity regulations stretches banks’ cybersecurity teams thin and hinders their ability to combat cyber threats and safeguard the nation’s financial system,” stated Hogsett. “A more coordinated and streamlined regulatory approach would not only enhance security and operational efficiency but also strengthen the financial sector’s collective defense against evolving threats.”
In her written testimony, Hogsett highlights several actions the government should prioritize as it reexamines existing cyber regulations:
- Withdraw and Reissue CISA’s Proposed Cyber Incident Reporting Rule. CISA’s proposed implementation of the Cyber Incident Reporting for Critical Infrastructure Act is overly broad, diverges from congressional intent and diverts critical cyber defense towards compliance rather than mitigating threats.
- Rescind the SEC’s Cyber Incident Disclosure Rule. Mandating public disclosures of ongoing cyber incidents could inadvertently aid cybercriminals by exposing a company’s vulnerabilities to other illicit actors, exacerbating harm to a company, its shareholders and its customers.
- Eliminate Duplicative Cyber Incident Reporting Requirements. Financial institutions currently navigate more than 10 separate cyber incident reporting mandates in the U.S. alone. Agencies should leverage CIRCIA as the primary reporting framework and eliminate bespoke requirements.
- Streamline Cybersecurity Regulatory Requirements and Supervision. Financial institutions are subject to cybersecurity examinations by multiple agencies, including the Office of the Comptroller of the Currency, the Federal Reserve and the FDIC. Consolidating redundant assessments and compliance obligations would free up critical cybersecurity resources and enhance operational efficiency.
Hogsett also underscored the need for Congress to reauthorize the Cybersecurity Information Sharing Act of 2015, which helps to enable information sharing between public and private entities. Without reauthorization, critical threat intelligence-sharing efforts could be severely disrupted.
To access the full testimony, please click here.
###
About Bank Policy Institute.
The Bank Policy Institute (BPI) is a nonpartisan public policy, research and advocacy group, representing the nation’s leading banks and their customers. Our members include universal banks, regional banks and the major foreign banks doing business in the United States. Collectively, they employ almost 2 million Americans, make nearly half of the nation’s small business loans, and are an engine for financial innovation and economic growth.
Media Contact
Austin Anton
