[joshdata]

U.S. law requires that agencies perform this public disclosure of their analysis so that interested parties in the general public have an opportunity to meaningfully weigh in before the proposed regulation becomes an actual regulation. It's an incredibly valuable aspect of accountability if you are someone affected by the regulation.

A more recent law also required that CISA create a regulation on this particular subject. (It's explained in the regulation itself.)

If you want simpler regulations, the issue isn't that we're missing a law to ensure regulations are simpler. The law requires that exactly this happen all the time: Your(?) legislators in Congress are constantly writing laws that direct agencies to do exactly this.

Of course, if they didn't and regulations were simpler, all of the ambiguity would be decided by courts instead. The world is complicated with or without complicated regulations. So we can either have less-ambiguous but more wordy laws, or we can have more ambiguity, more court cases, and judges unpredictably deciding how to resolve the ambiguity.