Industry Urges CISA to Narrow and Simplify CIRCIA Reporting Rule
Summary
Industry groups want CISA’s delayed CIRCIA rule to cover fewer organizations and incidents and collect less information. CISA says it is still working on the final rule, while Congress urges prompt action.
Key points
- Industry groups argued that the proposed rule could cover too many entities, including small businesses, and urged CISA to narrow its scope.
- Stakeholders said reporting should require less information and fewer incidents; some objected to reporting security measures or routine activity such as firewall scans.
- CIRCIA requires covered critical infrastructure entities to report major cyber incidents within 72 hours and ransomware payments within 24 hours.
- CISA missed its October 2025 deadline and a subsequent May target; the administration now says it aims to complete the rule in September.
- The House Appropriations Committee urged CISA to finalize the rule after stakeholder review, while industry sources expressed uncertainty about the timeline.
- CISA says the reports are intended to improve visibility into cyber threats and provide timely defensive information.
Article Details
- Event Type
- Stakeholder feedback and delays in finalizing CISA’s CIRCIA cyber incident reporting rule
- Impact
- Industry groups are urging CISA to narrow the organizations and incidents covered and reduce the information required in reports, citing compliance burden and concerns about reporting security measures. CISA has missed earlier finalization targets; the article says the administration now expects the rule in September, though industry sources doubt that timeline. No specific cyber incident or direct operational impact is reported.
People
Douglas LeighVice president of legislative affairs for the Alliance for Chemical Distribution; said the rule’s size- or sector-based criteria could include small chemical-distribution entities.Grant MacIntyreDirector of regulatory affairs and senior attorney at the Auto Care Association; argued that the proposed rule covers too many companies.Henry YoungSenior director of policy for the Business Software Alliance; expressed optimism that CISA would focus the rule on the most important incident information.Nick AndersenActing director of CISA; said CIRCIA is intended to support national early warning and provide timely defensive measures to critical-infrastructure network defenders.Samantha BurchVice president of technology public policy at AHIP; called for collecting the least information necessary in a format that supports accurate, timely reporting.Tim PospisilChief security officer for Nebraska Public Power District; warned that reporting requirements could encompass low-impact events such as firewall pings and become burdensome.
Industries
Chemical distributionsmall businesses,” said Douglas Leigh, vice president of legislative affairs for the Alliance for Chemical Distribution.Critical infrastructureThe debate comes as CISA has missed multiple deadlines for finalizing the rule, while Congress and critical infrastructure stakeholders push for a narrower, more practical final version.Health insurancesaid Samantha Burch, vice president of technology public policy at government affairs at AHIP, a health insurance industry trade association.InsuranceSome industries advocated for their removal entirely, such as two different groups representing elements of the insurance sector.Nuclear energySome sought to reduce the number affected within their sector, such as the Nuclear Energy Institute wanting the list cut down to those already subject to Nuclear Regulatory Commission cybersecurity reporting