Town Hall Meetings To Provide Input on Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Rulemaking

SIFMA, representing the financial services industry, opposes the proposed CIRCIA rule because it imposes overly burdensome and expansive reporting requirements that exceed statutory authorities. They argue the rule lacks a sufficiently high threshold for "substantial" incidents and request that reporting be limited to information directly related to an actionable purpose.

CrowdStrike, a global cybersecurity provider, supports the proposed CIRCIA rule but recommends refining the definitions of "covered incident" and "supply chain compromise" to focus on outcomes rather than specific attack vectors. They also advocate for potential exemptions or tailored assistance for small entities to ensure reporting requirements do not hinder incident remediation.

USTelecom, representing the broadband industry, supports the CIRCIA rulemaking but urges CISA to refine definitions for "covered cyber incidents" and "substantial cyber incidents" to focus on genuine national security risks. They also advocate for the creation of a centralized federal cyber incident reporting clearinghouse to harmonize reporting requirements across different government agencies.

The Business Roundtable, representing over 200 CEOs of leading U.S. companies, submitted comments to refine the CIRCIA rulemaking. They advocate for a risk-based approach that focuses on systemic impact rather than size-based criteria, while seeking to reduce compliance burdens, harmonize reporting requirements, and ensure robust data confidentiality.

HackerOne, a cybersecurity firm, supports the CIRCIA rulemaking but urges CISA to refine the definition of "substantial cyber incident" to focus on actual impacts on national critical functions. They also advocate for clarifying exclusions for independent good-faith security research and adopting a reciprocity principle to harmonize reporting requirements across different federal agencies.

The Edison Electric Institute (EEI), representing U.S. investor-owned electric companies, supports the overarching goals of the CIRCIA rule but urges CISA to refine the implementation to avoid duplicative reporting and excessive operational burdens. They recommend harmonizing requirements with existing frameworks, narrowing the definition of "substantial cyber incident," and ensuring that data retention and reporting timelines are practical for real-time incident response.

The American Chemistry Council (ACC) opposes the proposed CIRCIA rule, arguing that the definitions for "covered cyber incidents" and "covered entities" are overly broad and would lead to excessive overreporting. They advocate for a more targeted, risk-based approach that focuses on substantial business disruptions and requests simpler harmonization criteria and a shorter data retention period.

CTIA, representing the U.S. wireless communications industry, opposes the current proposed CIRCIA rules because they are overly broad and impose significant burdens on the private sector. They argue that CISA should adopt a more targeted, risk-based approach that focuses on substantial incidents impacting national security and critical infrastructure while streamlining reporting requirements and harmonizing rules with other agencies.