Town Hall Meetings To Provide Input on Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Rulemaking

The American Public Transportation Association (APTA) supports the CIRCIA rulemaking but urges CISA to streamline reporting processes, clarify reporting obligations for supply chain incidents, and coordinate with the TSA to harmonize regulations. They also emphasize the need for robust information protection, clear definitions of "substantial cyber incidents," and increased grant funding for transit agencies to meet cybersecurity standards.

SIFMA, representing the financial services industry, opposes the proposed CIRCIA rule because it imposes overly burdensome and expansive reporting requirements that exceed statutory authorities. They argue the rule lacks a sufficiently high threshold for "substantial" incidents and request that reporting be limited to information directly related to an actionable purpose.

Pinnacle Systems Group LLC, representing the AgGateway WG35 working group, supports the CIRCIA rulemaking but argues that the current proposal lacks sector-specific criteria and vocabulary for the Food and Agriculture Sector. They advocate for the adoption of an "agricultural data custodian" criterion to capture supply chain intermediaries and the use of the AgDataBOM Stewardship Metadata Profile to provide a standardized vocabulary for incident reporting.

CrowdStrike, a global cybersecurity provider, supports the proposed CIRCIA rule but recommends refining the definitions of "covered incident" and "supply chain compromise" to focus on outcomes rather than specific attack vectors. They also advocate for potential exemptions or tailored assistance for small entities to ensure reporting requirements do not hinder incident remediation.

The Alliance for Chemical Distribution (ACD) supports the CIRCIA rulemaking but urges CISA to narrow the scope of applicability to high-risk facilities using hazardous-release chemicals from Appendix A rather than the broader EPA Risk Management Program. They argue that a broader scope creates an overwhelming reporting burden that could hinder CISA's ability to respond effectively to cyber-attacks.

USTelecom, representing the broadband industry, supports the CIRCIA rulemaking but urges CISA to refine definitions for "covered cyber incidents" and "substantial cyber incidents" to focus on genuine national security risks. They also advocate for the creation of a centralized federal cyber incident reporting clearinghouse to harmonize reporting requirements across different government agencies.

The Business Roundtable, representing over 200 CEOs of leading U.S. companies, submitted comments to refine the CIRCIA rulemaking. They advocate for a risk-based approach that focuses on systemic impact rather than size-based criteria, while seeking to reduce compliance burdens, harmonize reporting requirements, and ensure robust data confidentiality.

The Competitive Carriers Association (CCA) supports CISA's renewed approach to the CIRCIA rulemaking but urges the agency to significantly streamline and narrow the draft regulations. They argue that the current proposed rules are overly broad, create excessive compliance burdens (especially for small and rural carriers), and risk overreporting while failing to sufficiently coordinate with other federal agencies.

Jeffrey Davis Jusino, a cybersecurity governance and risk professional, supports the CIRCIA rulemaking but suggests improvements to reduce organizational burden. He advocates for automated interagency reporting, clearer definitions of "substantial" incidents in operational technology environments, and safe-harbor protections for good-faith reporting.

HackerOne, a cybersecurity firm, supports the CIRCIA rulemaking but urges CISA to refine the definition of "substantial cyber incident" to focus on actual impacts on national critical functions. They also advocate for clarifying exclusions for independent good-faith security research and adopting a reciprocity principle to harmonize reporting requirements across different federal agencies.