GAO published its third report on cybersecurity regulatory harmonization on September 28, 2026, and if you have read the first two, you already know most of what is in it. Six industry panelists from energy, financial services, and healthcare told GAO, again, that federal cybersecurity rules overlap, conflict, and cost real money to comply with. This is the fourth time since 2020 that GAO has said some version of this sentence, and the twelfth year running that information security has sat on GAO’s High Risk list. Nobody in this story is surprised by any of it, which is itself the story.
But buried in footnote 14, on page 4, is the detail that actually matters. National Security Memorandum 22, the White House directive that was supposed to be the coordinating spine of federal critical infrastructure policy, is gone. Not repealed, not superseded by a new memorandum with a different number. Just gone from the public website, “under review” since sometime before August 2026, with no explanation and no return date. GAO’s footnote is the driest possible way to report that a governing national security document disappeared from public view while the very agencies it was supposed to coordinate kept generating the conflicting paperwork it was meant to fix.
A Memorandum With No Forwarding Address
NSM-22 was signed in April 2024 to replace a decade old Obama era directive, and it did what these documents do; it named the Department of Homeland Security as the lead coordinator, designated CISA as the “National Coordinator for Security and Resilience,” reaffirmed the 16 critical infrastructure sectors, and ordered a biennial National Risk Management Plan. It was, in the language of the trade press at the time, a “good first step.” It was also, per GAO’s own report, the connective tissue between an alphabet soup of sector regulators who were each writing their own cyber incident reporting rules without much reference to each other.
That memorandum is now archived on a “frozen in time” Biden administration website, unavailable through the current White House’s own channels. GAO’s report says only that it “was under review and was no longer available on the White House’s public website” as of August 2026. There is no public indication of what replaces it, when a replacement might arrive, or whether the current administration considers the underlying coordination problem worth solving through the same mechanism. In March 2026, the White House did issue a new national cyber strategy that promised to remove burdensome or ineffective regulations and increase coordination; whatever that strategy is, it apparently did not require keeping the last coordination directive online while the new one gets sorted out.
This is the part GAO cannot say directly, because GAO audits process, not politics, but the panelists said it for them. Participants told GAO there is tension between reliability and modernization, that companies are pushed toward new technology while stuck inside compliance frameworks that do not move at the same speed. Take away the coordinating memorandum in the middle of that tension, and you have not solved the duplication problem. You have removed the one document whose entire job was to say who is supposed to solve it.
The Rule That Keeps Almost Arriving
If NSM-22 is the memo nobody can find, CIRCIA is the rule nobody can finish. Congress passed the Cyber Incident Reporting for Critical Infrastructure Act in March 2022, giving CISA 24 months to propose a rule and 18 more to finalize it. CISA hit the first deadline, publishing its proposed rule in April 2024. It has missed every deadline since. The statutory finalization date was October 2025. CISA missed that, moved the target to May 2026, missed that too after a DHS appropriations lapse postponed a round of stakeholder town halls, held those town halls in June, and now says the rule is finally coming this month, September 2026, three and a half years after the statute that ordered it and eleven months past the deadline that statute set.
The industry panelists, naturally, have feelings about this. Most participants named the proposed CIRCIA rule or the SEC’s cybersecurity disclosure requirements as the regulations most likely to conflict with their own sector’s rules, the only two cited across all three sectors on the panel. A few in financial services walked GAO through what compliance actually looks like in practice; a single cyber incident can trigger a 72 hour reporting clock under the National Credit Union Administration, a four business day clock under the SEC, and a 24 to 72 hour clock under the still unfinished CIRCIA rule, each with its own definition of what counts as reportable. One participant put it about as plainly as a GAO transcript allows, describing what should exist instead as one report that satisfies multiple requirements where the underlying information is the same.
CIRCIA itself contains a provision meant to do exactly that, letting a covered entity skip reporting to CISA if it already reported “substantially similar” information to another agency on a similar timeline. It is a good idea sitting in a rule that has been not yet final for three and a half years, which means the harmonizing mechanism industry keeps asking for has existed on paper since 2022 and has never once taken effect.
Same Six Chairs, Same Complaints
GAO’s methodology section is almost touching in its consistency. This is the third panel in a series that started in 2025, and GAO notes plainly that the views expressed in July 2026 “were generally similar” to the two prior sessions. Six panelists, three sectors, one afternoon of Zoom, and a report structure that has by now calcified into ritual; identify the duplicative regulations, quantify how many, note limited progress, list the same three suggestions that never quite get adopted (harmonize incident reporting, consolidate agency authority, increase collaboration).
What has changed between reports is not the complaints. It is the backdrop against which the complaints are being repeated. In 2025, industry was asking for harmonization while CIRCIA’s rule was merely late. By the second report in March 2026, it was later. By this third report, the rule is theoretically imminent, but the document that was supposed to make sure it plays well with SEC, HIPAA, NCUA, and everything else has quietly disappeared from public view. GAO can keep convening panels and counting regulations for as long as Congress asks it to. What it cannot do, and does not pretend to do, is explain why the coordinating apparatus keeps getting thinner every time the underlying problem gets documented again.
Six industry executives spent three hours in July telling GAO, on the record for the third time, that the federal government’s cybersecurity rules do not talk to each other. The federal government’s response, so far, has been to remove the memo that was supposed to make them.
