ONCD extends deadline for comments on new sector cybersecurity requirements

The Office of the National Cyber Director has extended the deadline by which it is seeking to collect evidence from industry on new baseline cybersecurity requirements.

Previously, members of the cybersecurity community including regulated entities, academics and nonprofits had until Sept. 15 to submit their comments. They now have until Oct. 31.

The White House earlier this month issued a request for information as it seeks views on how to harmonize and streamline new proposed cybersecurity regulations across all sectors of the U.S. economy.

In particular, the White House wants to understand how updated requirements for the critical infrastructure sector could be harmonized with requirements for other industries.

In an updated note in the Federal Register, ONCD said it “seeks input from stakeholders to understand existing challenges with regulatory overlap, and explore a framework for reciprocity in regulator acceptance of other regulators’ recognition of compliance with baseline requirements.”

“‘Harmonization’ as used in this RFI refers to a common set of updated baseline regulatory requirements that would apply across sectors. Sector regulators could go beyond the harmonized baseline to address cybersecurity risks specific to their sectors,” it added.

In March, the Biden administration issued a new national cybersecurity strategy, which included measures to impose minimum security standards for critical infrastructure and to shift the responsibility for maintaining the security of computer systems away from consumers and small businesses onto larger software makers. 

That document represented a shift from the White House’s more recent approach to cybersecurity, veering from its long-standing emphasis on information sharing and collaboration toward a more strictly regulated approach.