Comment submitted by HackerOne Inc

Summary: HackerOne, a cybersecurity firm, supports the CIRCIA rulemaking but urges CISA to refine the definition of "substantial cyber incident" to focus on actual impacts on national critical functions. They also advocate for clarifying exclusions for independent good-faith security research and adopting a reciprocity principle to harmonize reporting requirements across different federal agencies.