Congress creates cybersecurity waiver authority, bypassing public comment rules

What it does

This bill creates a federal Harmonization Committee led by the National Cyber Director to align cybersecurity regulations across different government agencies and sectors. The committee will develop a common baseline of cybersecurity requirements, identify conflicting or redundant rules, and run a 7-year pilot program allowing selected agencies to waive or modify rules for participating companies—with the goal of reducing regulatory burden while maintaining security standards.

Why we flagged it

The bill frames itself as a coordination and efficiency measure, but its core mechanism is to establish a committee with authority to waive cybersecurity requirements during a 7-year pilot, effectively creating a deregulation pathway that bypasses standard Administrative Procedure Act notice-and-comment processes.

What the text implies

• The pilot program grants regulatory agencies authority to issue waivers and establish alternative procedures 'notwithstanding' the Administrative Procedure Act, potentially allowing cybersecurity rules to be suspended or modified without full public comment periods, reducing transparency in how security standards are set.
• Reciprocity provisions allow one agency's assessment of compliance to satisfy another agency's requirements, which may create a 'lowest common denominator' effect where a company complying with a weaker regulator's standard is deemed compliant across all sectors, potentially lowering overall security posture.
• The 7-year sunset on the pilot program is lengthy enough to entrench alternative procedures and waivers as de facto permanent, and the bill allows the Committee to authorize additional pilot programs sequentially, potentially extending deregulation indefinitely.
• Industry participation in the pilot is voluntary, but once a company opts in, it receives compliance relief; this creates incentive for regulated entities to lobby for inclusion, shifting power toward those with regulatory affairs capacity and away from smaller or less-resourced competitors.
• The bill requires consultation with the Committee before new cybersecurity rules are issued, but consultation is 'advisory' and does not bind agencies—creating a procedural hurdle that may slow security updates without guaranteeing alignment, especially during exigent circumstances.

Who it affects

Citizens may benefit from reduced regulatory confusion and lower compliance costs for critical infrastructure and financial institutions, potentially improving service availability and pricing. However, the pilot program's waiver authority and 7-year exemption from standard rulemaking procedures (Administrative Procedure Act) create risk that cybersecurity standards could be weakened without full public notice or comment, and the bill prioritizes industry convenience over transparent regulatory

Who stands to gain

• Large financial institutions and critical infrastructure operators (banks, energy, telecom) subject
• Cybersecurity consulting and compliance firms (Cognizant, Accenture, others) that may benefit from h
• Technology vendors (Cisco, HPE, AMD, Verisign) whose products are subject to varying security certif

Named in the bill

National Cyber Director, Harmonization Committee, Cybersecurity and Infrastructure Security Agency (CISA), National Institute of Standards and Technology (NIST), Office of Management and Budget (OMB), Office of Information and Regulatory Affairs (OIRA), Sector Risk Management Agencies, Independent regulatory agencies, Cisco (CSCO), Hewlett Packard Enterprise (HPE), AMD, Verisign (VRSN) — and 1 more

Where it stands

1 cosponsor: 1 Republicans.

• May 22, 2025 — Introduced · Congress.gov: “Introduced in Senate”
• May 22, 2025 — Referred to Senate Committee on Homeland Security and Governmental Affairs · Congress.gov: “Read twice and referred to the Committee on Homeland Security and Governmental Affairs”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

15 lobbying clients named this bill on 22 disclosure filings across 3 quarters, Dec 2025 to Jun 2026. Those filings disclosed $26,578,610 in lobbying spend. A filing names 46 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 95% of bills with at least one filing.

Gary Peters, the sponsor, reported $-186,100 in PAC receipts in the 2026 cycle. $-7,500 of that came from 2 PACs tied to these lobbying clients.

• Chamber of Commerce of the U.S.A. — $17,960,000 on 1 filing
• Edison Electric Institute — $4,248,610 on 2 filings
• Puget Sound Energy — $750,000 on 2 filings
• Entergy Services LLC — $710,000 on 1 filing
• Itc Holdings Corp — $420,000 on 2 filings

Lobbying Disclosure Act filings through Jul 20, 2026. A filing shows who paid to lobby on a bill it names, not what changed.