Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements

Federal RegisterApr 4, 2024

Ask Donna

What actually matters in this document.

Text

DEPARTMENT OF HOMELAND SECURITY

Cybersecurity and Infrastructure Security Agency

6 CFR Part 226

[Docket No. CISA-2022-0010]

RIN 1670-AA04

Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements

AGENCY:

Cybersecurity and Infrastructure Security Agency, DHS

ACTION:

Proposed rule.

SUMMARY:

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), as amended, requires the Cybersecurity and Infrastructure Security Agency (CISA) to promulgate regulations implementing the statute's covered cyber incident and ransom payment reporting requirements for covered entities. CISA seeks comment on the proposed rule to implement CIRCIA's requirements and on several practical and policy issues related to the implementation of these new reporting requirements.

DATES:

Comments and related material must be submitted on or before June 3, 2024.

ADDRESSES:

You may send comments, identified by docket number CISA-2022-0010, through the Federal eRulemaking Portal available at

http://www.regulations.gov.

Instructions:

All comments received must include the docket number for this rulemaking. All comments received will be posted to

https://www.regulations.gov,

including any personal information provided. If you cannot submit your comment using

https://www.regulations.gov,

contact the person in the

FOR FURTHER INFORMATION CONTACT

section of this proposed rule for alternate instructions. For detailed instructions on sending comments and additional information on the types of comments that are of particular interest to CISA for this proposed rulemaking, see the “Public Participation” heading of the

SUPPLEMENTARY INFORMATION

section of this document.

Docket:

For access to the docket and to read background documents mentioned in this proposed rule and comments received, go to

https://www.regulations.gov.

FOR FURTHER INFORMATION CONTACT:

Todd Klessman, CIRCIA Rulemaking Team Lead, Cybersecurity and Infrastructure Security Agency,

circia@cisa.dhs.gov,

202-964-6869.

SUPPLEMENTARY INFORMATION:

Table of Contents

I. Public Participation

II. Executive Summary

A. Purpose and Summary of the Regulatory Action

B. Summary of Costs and Benefits

III. Background and Purpose

A. Legal Authority

B. Current Cyber Incident Reporting Landscape

C. Purpose of Regulation

i. Purposes of the CIRCIA Regulation

ii. How the Regulatory Purpose of CIRCIA Influenced the Design of the Proposed CIRCIA Regulation

D. Harmonization Efforts

E. Information Sharing Required by CIRCIA

F. Summary of Stakeholder Comments

i. General Comments

ii. Comments on the Definition of Covered Entity

iii. Comments on the Definition of Covered Cyber Incident and Substantial Cyber Incident

iv. Comments on Other Definitions

v. Comments on Criteria for Determining Whether the Domain Name System Exception Applies

vi. Comments on Manner and Form of Reporting, Content of Reports, and Reporting Procedures

vii. Comments on the Deadlines for Submission of CIRCIA Reports

viii. Comments on Third-Party Submitters

ix. Comments on Data and Records Preservation Requirements

x. Comments on Other Existing Cyber Incident Reporting Requirements and the Substantially Similar Reporting Exception

xi. Comments on Noncompliance and Enforcement

xii. Comments on Treatment and Restrictions on Use of CIRCIA Reports

IV. Discussion of Proposed Rule

A. Definitions

i. Covered Entity

ii. Cyber Incident, Covered Cyber Incident, and Substantial Cyber Incident

iii. CIRCIA Reports

iv. Other Definitions

v. Request for Comments on Proposed Definitions

B. Applicability

i. Interpreting the CIRCIA Statutory Definition of Covered Entity

ii. Determining if an Entity Is in a Critical Infrastructure Sector

iii. Clear Description of the Types of Entities That Constitute Covered Entities Based on Statutory Factors

iv. Explanation of Specific Proposed Applicability Criteria

v. Other Approaches Considered To Describe Covered Entity

vi. Request for Comments on Applicability Section

C. Required Reporting on Covered Cyber Incidents and Ransom Payments

i. Overview of Reporting Requirements

ii. Reporting of Single Incidents Impacting Multiple Covered Entities

D. Exceptions to Required Reporting on Covered Cyber Incidents and Ransom Payments

i. Substantially Similar Reporting Exception

ii. Domain Name System (DNS) Exception

iii. Exception for Federal Agencies Subject to Federal Information Security Modernization Act Reporting Requirements

E. Manner, Form, and Content of Reports

i. Manner of Reporting

ii. Form for Reporting

iii. Content of Reports

iv. Timing of Submission of CIRCIA Reports

v. Report Submission Procedures

vi. Request for Comments on Proposed Manner, Form, and Content of Reports

F. Data and Records Preservation Requirements

i. Types of Data That Must Be Preserved

ii. Required Preservation Period

iii. Data Preservation Procedural Requirements

iv. Request for Comments on Proposed Data Preservation Requirements

G. Enforcement

i. Overview

ii. Request for Information

iii. Subpoena

iv. Service of an RFI, Subpoena, or Notice of Withdrawal

v. Enforcement of Subpoenas

vi. Acquisition, Suspension, and Debarment Enforcement Procedures

vii. Penalty for False Statements and Representations

viii. Request for Comments on Proposed Enforcement

H. Protections

i. Treatment of Information and Restrictions on Use

ii. Protection of Privacy and Civil Liberties

iii. Digital Security

iv. Request for Comments on Proposed Protections

I. Severability

V. Statutory and Regulatory Analyses

A. Regulatory Planning and Review

i. Number of Reports

ii. Industry Cost

iii. Government Cost

iv. Combined Costs

v. Benefits

vi. Accounting Statement

vii. Alternatives

B. Small Entities

C. Assistance for Small Entities

D. Collection of Information

E. Federalism

F. Unfunded Mandates Reform Act

G. Taking of Private Property

H. Civil Justice Reform

I. Protection of Children

J. Indian Tribal Governments

K. Energy Effects

L. Technical Standards

M. National Environmental Policy Act

VI. Proposed Regulation

List of Tables

Table 1: Affected Population, by Criteria

Table 2: Number of CIRCIA Reports, Primary Estimate

Table 3: Number of CIRCIA Reports

Table 4: Familiarization Cost by Entity Type, Primary Estimate

Table 5: Total Familiarization Costs ($ Millions, Undiscounted)

Table 6: Cost of CIRCIA Reporting

Table 7: Data and Record Preservation Costs

Table 8: Industry Cost Range, ($ Millions, Undiscounted)

Table 9: Total Industry Cost, Primary Estimate ($ Millions)

Table 10: Cost by Covered Entity Criteria, ($ Millions, Undiscounted)

Table 11: Government Cost ($ Millions)

Table 12: Combined Industry and Government Cost, Primary Estimate ($ Millions)

Table 13: Combined Industry and Government Cost Range, ($ Millions)

Table 14: Summary of Cyber Event Losses and Counts, IRIS 2022

Table 15: OMB A-4 Accounting Statement ($ Millions, 2022 Dollars)

Table 16: Alternative 1 Industry Cost, Primary Estimate ($ Millions)

Table 17: Alternative 1 Combined Industry and Government Cost, Primary Estimate, ($ Millions)

Table 18: Alternative 2 Industry Cost, Primary Estimate ($ Millions)

Table 19: Alternative 2 Combined Industry and Government Cost, Primary Estimate ($ Millions)

Table 20: Alternative 3 Industry Cost, Primary Estimate ($ Millions)

Table 21: Alternative 3 Combined Industry and Government Cost, Primary Estimate ($ Millions)

Table 22: Affected Population by Critical Infrastructure Sector

Table 23: Alternative 4 Industry Cost, Primary Estimate ($ Millions)

Table 24: Alternative 4 Combined Industry and Government Costs, Primary Estimate ($ Millions)

Table 25: Alternatives Summary, Combined Industry and Government Cost, Primary Estimate ($ Millions)

Abbreviations and Acronyms Frequently Used in This Document

ARIN American Registry for Internet Numbers

ATO Authority to Operate

BES Bulk Electric System

CFATS Chemical Facility Anti-Terrorism Standards

CFTC Commodity Futures Trading Commission

CHS U.S. House Committee on Homeland Security

CIA Confidentiality, Integrity, and Availability

CIP Critical Infrastructure Protection

CIRC Cyber Incident Reporting Council

CIRCIA Cyber Incident Reporting for Critical Infrastructure Act of 2022, as amended

CISA Cybersecurity and Infrastructure Security Agency

CSP Cloud Service Provider

DFARS Defense Federal Acquisition Regulation Supplement

DHS Department of Homeland Security

DNS Domain Name System

DOD Department of Defense

DOE Department of Energy

DOJ Department of Justice

EPA Environmental Protection Agency

ESA Educational Service Agency

FBI Federal Bureau of Investigation

FCC Federal Communications Commission

FDA Food and Drug Administration

FDIC Federal Deposit Insurance Corporation

FedRAMP Federal Risk and Authorization Management Program

FERC Federal Energy Regulatory Commission

FHFA Federal Housing Finance Agency

FICU Federally Insured Credit Union

FISMA Federal Information Security Modernization Act of 2014

FOIA Freedom of Information Act

FRB Federal Reserve Board

GAO Government Accountability Office

GCC Government Coordinating Council

GSA General Services Administration

gTLD Generic Top-Level Domain

HHS Department of Health and Human Services

HIPAA Health Insurance Portability and Accountability Act of 1996

HITECH Health Information Technology for Economic and Clinical Health

HSGAC U.S. Senate Committee on Homeland Security and Governmental Affairs

IANA Internet Assigned Numbers Authority

ICANN Internet Corporation for Assigned Names and Numbers

ICT Information and Communications Technology

IHE Institute of Higher Education

IP Internet Protocol

ISAC Information Sharing and Analysis Center

IT Information Technology

K-12 Kindergarten through 12th Grade

LEA Local Educational Agency

MTSA Maritime Transportation Security Act

NAICS North American Industry Classification System

NCF National Critical Function

NCUA National Credit Union Administration

NERC North American Electric Reliability Corporation

NIPP National Infrastructure Protection Plan

NIST National Institute of Standards and Technology

NORS Network Outage Reporting System

NPRM Notice of Proposed Rulemaking

NRC Nuclear Regulatory Commission

NSA National Security Agency

OCC Office of the Comptroller of the Currency

OEM Original Equipment Manufacturer

OMB Office of Management and Budget

OT Operational Technology

OTRB Over-the-Road Bus

POTW Publicly Owned Treatment Works

PPD Presidential Policy Directive

PRA Paperwork Reduction Act

PTPR Public Transportation and Passenger Railroads

RFI Request for Information

RIR Regional Internet Registry

RTR Research and Test Reactor

RSO Root Server Operator

SBA Small Business Administration

SCC Sector Coordinating Council

SEA State Educational Agency

SEC Securities and Exchange Commission

SLTT State, Local, Tribal, or Territorial

SRMA Sector Risk Management Agency

SSP Sector-Specific Plan

TLD Top-Level Domain

TSA Transportation Security Administration

TTP Tactics, Techniques, and Procedures

USCG United States Coast Guard

USDA United States Department of Agriculture

VoIP Voice over Internet Protocol

I. Public Participation

The Cybersecurity and Infrastructure Security Agency (CISA) views public participation as essential to effective rulemaking and invites interested persons to participate by submitting data, comments, and other information on the content and assumptions made in this proposed rule. Your comments can help shape the outcome of this rulemaking. CISA is particularly interested in comments on the following:

Proposed Definitions.

The proposed definition of covered cyber incident and the other definitions CISA is proposing to include in the regulation (see proposed § 226.1 and Section IV.A in this document);

Applicability.

The proposed description of covered entity, the scope of entities to whom this regulation applies (see proposed § 226.2 and Section IV.B in this document);

Examples of Reportable Covered Cyber Incidents.

The examples of substantial cyber incidents included in this Notice of Proposed Rulemaking (NPRM) (see Section IV.A.ii.3.e in this document);

CIRCIA Reporting Requirements and Procedures.

The proposed reporting requirements and procedures for CIRCIA Reports, specifically the manner, form, and content of CIRCIA Reports (see proposed §§ 226.6 through 226.12 and Section IV.E.i-iii in this document), including CISA's proposal to use a single, dynamic, web-based form as the primary means of submission for all CIRCIA Reports (see Section IV.E.i.2 in this document);

Proposed CIRCIA Report Submission Deadlines.

The proposed deadlines for submitting CIRCIA Reports and CISA's proposed interpretations of these submission deadline requirements (see proposed § 226.5 and Section IV.E.iv in this document);

Data and Records Preservation Requirements.

The proposed data and records preservation requirements and preservation period (see proposed § 226.13 and Section IV.F in this document);

Enforcement Procedures.

The proposed enforcement procedures, including the procedures related to

issuance of a Request for Information (RFI) or subpoena and the proposed subpoena withdrawal and appeals process (see proposed §§ 226.14 through 226.17 and Section IV.G in this document);

Treatment of Information and Restrictions on Use.

The proposed rules governing the protections and restrictions on the use of CIRCIA Reports, information included in such reports, and responses to RFIs (see proposed § 226.18 and Section IV.H.i in this document); and

Procedures for Protecting Privacy and Civil Liberties.

The proposed procedures governing the protection of personal information contained in CIRCIA Reports and responses to RFIs (see proposed § 226.19 and Section IV.H.ii in this document), which are further described in the draft Privacy and Civil Liberties Guidance for CIRCIA (this draft document is available in the docket for this proposed regulatory action (CISA-2022-0010)).

CISA is including in the docket a draft privacy and civil liberties guidance document that would apply to CISA's retention, use, and dissemination of personal information contained in a CIRCIA Report and guide other Federal departments and agencies with which CISA will share CIRCIA Reports. CISA encourages interested readers to review this draft guidance and to submit comments on it. Commenters should clearly identify which specific comment(s) concern the draft guidance document.

CISA will accept comments no later than the date provided in the

DATES

section of this document. Interested parties may submit data, comments, and other information using any of the methods described in the

ADDRESSES

section of this document. To ensure appropriate consideration of your comment, indicate the specific section of this proposed rule and, if applicable, the specific comment request number associated with the topic to which each comment applies; explain a reason for any suggestion or recommendation; and include data, information, or authority that supports the recommended course of action. Comments submitted in a manner other than those described above, including emails or letters sent to Department of Homeland Security (DHS) or CISA officials, will not be considered comments on the proposed rule and may not receive a response from CISA.

Instructions to Submit Comments.

If you submit a comment, you must submit it to the docket associated with CISA Docket Number CISA-2022-0010. All submissions may be posted, without change, to the Federal eRulemaking Portal at

www.regulations.gov

and will include any personal information that you provide. You may choose to submit your comment anonymously. Additionally, you may upload or include attachments with your comments. Do not upload any material in your comments that you consider confidential or inappropriate for public disclosure. Do not submit comments that include trade secrets, confidential commercial or financial information, Protected Critical Infrastructure Information, Sensitive Security Information, or any other protected information to the public regulatory docket. Please submit comments containing protected information separately from other comments by contacting the individual listed in the

FOR FURTHER INFORMATION CONTACT

section of this document for instructions on how to submit comments that include protected information. CISA will not place comments containing protected information in the public docket and will handle them in accordance with applicable safeguards and restrictions on access. CISA will hold such comments in a separate file to which the public does not have access and place a note in the public docket documenting receipt. If CISA receives a request for a copy of any comments submitted containing protected information, CISA will process such a request consistent with the Freedom of Information Act (FOIA), 5 U.S.C. 552, and the Department's FOIA regulation found in part 5 of title 6 of the Code of Federal Regulations (CFR).

To submit a comment, go to

www.regulations.gov,

type CISA-2022-0010 in the search box and click “Search.” Next, look for this

Federal Register

notice of proposed rulemaking in the Search Results column, and click on it. Then click on the Comment option. If you cannot submit your comment by using

https://www.regulations.gov,

call or email the point of contact in the

FOR FURTHER INFORMATION CONTACT

section of this document for alternate instructions.

Viewing material in docket.

For access to the docket and to view documents mentioned in this NPRM as being available in the docket, go to

https://www.regulations.gov,

search for the docket number provided in the previous paragraph, and then select “Supporting & Related Material” in the Document Type column. Public comments will also be placed in the docket and can be viewed by following instructions on the Frequently Asked Questions web page

https://www.regulations.gov/faq.

The Frequently Asked Questions page also explains how to subscribe for email alerts that will notify you when comments are posted or if another

Federal Register

document is published. CISA will review all comments received. CISA may choose to withhold information provided in comments from public viewing or to not post comments that CISA determines are off-topic or inappropriate.

Public meeting.

CISA does not plan to hold additional public meetings at this time, but may consider doing so if CISA determines from public comments that a meeting would be helpful. If CISA decides to hold a public meeting, a notice announcing the date, time, and location for the meeting will be issued in a separate

Federal Register

notice.

II. Executive Summary

A. Purpose and Summary of the Regulatory Action

On March 15, 2022, the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) was signed into law. See 6 U.S.C. 681-681g; Public Law 117-103, as amended by Public Law 117-263 (Dec. 23, 2022). CIRCIA requires covered entities to report to CISA within certain prescribed timeframes any covered cyber incidents, ransom payments made in response to a ransomware attack, and any substantial new or different information discovered related to a previously submitted report. 6 U.S.C. 681b(a)(1)-(3). CIRCIA further requires the Director of CISA to implement these new reporting requirements through rulemaking, by issuing an NPRM no later than March 15, 2024, and a final rule within 18 months of publication of the NPRM. 6 U.S.C. 681b(b). CISA is issuing this NPRM to solicit public comment on proposed regulations that would codify these reporting requirements.

This NPRM is divided into six sections. Section I—Public Participation describes the process for members of the public to submit comments on the proposed regulations and lists specific topics on which CISA is particularly interested in receiving public comment. Section II—Executive Summary contains a summary of the proposed regulatory action and the anticipated costs and benefits of the proposed regulations. Section III—Background and Purpose contains a summary of the legal authority for this proposed regulatory action; an overview of the current regulatory cyber incident reporting landscape; a description of the purpose of the proposed regulations; a discussion of efforts CISA has taken to

harmonize these proposed regulations with other Federal cyber incident reporting regulations; a discussion of information sharing activities related to the proposed regulations; and a summary of the comments CISA received in response to an RFI issued by CISA on approaches to the proposed regulations and during listening sessions hosted by CISA on the same topic. Section IV—Discussion of Proposed Rule includes a detailed discussion of the proposed rule, the justification for CISA's specific proposals, and the alternatives considered by CISA. Section V—Statutory and Regulatory Analyses contains the analyses that CISA is required by statute or Executive Order to perform as part of the rulemaking process prior to issuance of the final rule, such as the Initial Regulatory Flexibility Analysis and Unfunded Mandates Reform Act analysis. Section VI contains the proposed regulatory text.

The proposed rule is comprised of 20 sections, §§ 226.1 through 226.20, beginning with a section containing definitions for a number of key terms used throughout the proposed regulation. Among other definitions, § 226.1 includes proposed definitions for the terms used to describe and ultimately scope what types of incidents must be reported to CISA (

i.e.,

cyber incident, covered cyber incident, ransom payment, and substantial cyber incident) and the term used to describe the different types of reports that must be submitted (

i.e.,

CIRCIA Reports).

The next section of the proposed rule, § 226.2, describes the applicability of the proposed rule to certain entities in a critical infrastructure sector,

i.e.,

those entities that are considered covered entities and to whom the operative provisions of the rule would apply.

The next section of the proposed rule, § 226.3, describes the circumstances under which a covered entity must submit a CIRCIA Report to CISA. This includes when a covered entity experiences a covered cyber incident, makes a ransom payment, has another entity make a ransom payment on its behalf, or acquires substantial new or different information after submitting a previous CIRCIA Report. See § 226.3; Section IV.C in this document. CISA is proposing three exceptions to these reporting requirements for covered entities, which are in § 226.4 of the proposed regulation and described in Section IV.D in this document. These exceptions include when a covered entity reports substantially similar information in a substantially similar timeframe to another Federal agency pursuant to an existing law, regulation, or contract when a CIRCIA Agreement is in place between CISA and the other Federal agency; when an incident impacts certain covered entities related to the Domain Name System (DNS); and when Federal agencies are required by the Federal Information Security Modernization Act of 2014 (FISMA) to report incidents to CISA. See § 226.4 of the proposed regulation and Section IV.D of this document.

Section 226.5 of the proposed regulation contains the submission deadlines for the four different types of CIRCIA Reports (

i.e.,

Covered Cyber Incident Reports; Ransom Payment Reports; Joint Covered Cyber Incident and Ransom Payment Reports; Supplemental Reports). These deadlines, including how to calculate them, are discussed further in Section IV.E.iv in this document. Section 226.6 of the proposed regulation sets forth the proposed manner and form of reporting, which CISA proposes to be through a web-based CIRCIA Incident Reporting Form available on CISA's website or in any other manner and form of reporting approved by the Director. Additional details on the proposed manner and form of reporting and related submission procedures are contained in Sections IV.E.i, ii and v in this document. The information CISA proposes that covered entities must include in each of the four types of CIRCIA Reports is enumerated in §§ 226.7 through 226.11 and expanded upon in Section IV.E.iii in this document.

A covered entity may use a third party to submit a CIRCIA Report to CISA on the covered entity's behalf to satisfy the covered entity's reporting obligations. See 6 U.S.C. 681b(d). The proposed procedures and requirements for using a third party to submit a CIRCIA Report on behalf of the covered entity are contained in § 226.12 of the proposed regulations and discussed in detail in Section IV.E.v.3 in this document. The proposed regulation also affirms the statutorily mandated obligation for a third party to advise the covered entity of its ransom payment reporting obligations under CIRCIA when the third party knowingly makes a ransom payment on behalf of a covered entity. See 6 U.S.C. 681b(d)(4), § 226.12(d) of the proposed regulations, and Section IV.E.v.3.e of the NPRM.

Section 226.13 of the proposed regulation sets forth the proposed data and records preservation requirements. It includes a recitation of the types of data and records that a covered entity must preserve; the required preservation period; the format or form in which the data and records must be preserved; and the storage, protection, and allowable uses of the preserved data and records. See § 226.13 and Section IV.F in this document.

CIRCIA authorizes CISA to use various mechanisms to obtain information from a covered entity about a covered cyber incident or ransom payment that was not reported in accordance with CISA's proposed regulatory reporting requirements. 6 U.S.C. 681d. These mechanisms include the issuance of an RFI; the issuance of a subpoena; a referral to the Attorney General to bring a civil action in District Court to enforce a subpoena; and acquisition, suspension, and debarment enforcement procedures. The proposed procedures for each of these enforcement mechanisms are contained in §§ 226.14 through 226.17 of the proposed regulation and discussed in Section IV.G.i-vi in this document.

CIRCIA provides a variety of requirements related to the treatment and restrictions on the use of CIRCIA Reports, information contained in such reports, as well as information submitted in response to an RFI. See 6 U.S.C. 681e(b), 681e(a)(1), (5). CIRCIA also provides liability protection for the submission of a CIRCIA Report in compliance with the reporting requirements established in the CIRCIA regulation. 6 U.S.C. 681e(c). To ensure that such requirements related to the treatment and restrictions on the use of CIRCIA Reports are applied consistently, CISA proposes to include them in § 226.18, as discussed in Section IV.H.i in this document. CISA additionally proposes steps to minimize the collection of unnecessary personal information in CIRCIA Reports and additional procedures for protecting privacy and civil liberties related to the submission of CIRCIA Reports and responses to RFIs. These proposed procedures for protecting privacy and civil liberties are contained in § 226.19 of the proposed regulation and discussed further in Section IV.H.ii in this document as well as in the guidance document posted to the docket for this proposed rule.

The final section of the proposed regulation, § 226.20, proposes two distinct procedural provisions. The first proposed provision provides that any person who knowingly and willfully makes a materially false or fraudulent statement or representation in connection with, or within, a CIRCIA Report, RFI response, or reply to an administrative subpoena is subject to penalties under 18 U.S.C. 1001. § 226.20(a). The second proposed provision is a severability clause, which

states CISA intends the various provisions of this part to be severable from each other to the extent practicable, such that if a court of competent jurisdiction were to vacate or enjoin any one provision, the other provisions remain in effect unless they are dependent upon the vacated or enjoined provision. § 226.20(b). These are discussed in Sections IV.G.vii and IV.I in this document, respectively.

B. Summary of Costs and Benefits

CISA estimates the cost of this proposed rule would be $2.6 billion over the period of analysis

(undiscounted). CISA estimates that there will be 316,244 entities potentially affected by the proposed rule (

i.e.,

covered entities) who collectively will submit an estimated total of 210,525 CIRCIA Reports over the period of analysis, resulting in $1.4 billion (undiscounted) in cost to industry and $1.2 billion (undiscounted) in cost to the Federal Government. The cost over the period of analysis discounted at 2% would be $2.4 billion ($1.3 billion for industry, $1.1 billion for government), with an annualized cost of $244.6 million, as presented in the Preliminary Regulatory Impact Analysis (RIA) included in the docket. The main industry cost drivers of this proposed rule are the initial costs associated with becoming familiar with the proposed rule, followed by the recurring data and records preservation requirements, and then reporting requirements. Other industry costs include those associated with help desk calls and enforcement actions. Government costs include costs CISA anticipates incurring associated with the creation, implementation, and operation of the government infrastructure needed to run the CIRCIA program. This includes both personnel and technology costs necessary to support the receipt, analysis, and sharing of information from CIRCIA Reports submitted to CISA.

CISA used an 11-year period of analysis spanning from 2023-2033 to reflect that CISA began incurring costs related to CIRCIA implementation in 2023, one year prior to the publication of the NPRM. See the Executive Summary section of the

CIRCIA Regulation Proposed Rulemaking Preliminary Regulatory Impact Analysis and Initial Regulatory Flexibility Analysis

for additional detail on the period of analysis.

The Preliminary RIA also discusses the qualitative benefits of the proposed rule. From a qualitative benefits perspective, the proposed reporting requirements, analytical activities, and information sharing will lead to Federal and non-Federal stakeholders having the ability to adopt an enhanced overall level of cybersecurity and resiliency, resulting in direct, tangible benefits to the nation. For example:

• By supporting CISA's ability to share information that will enable non-Federal and Federal partners to detect and counter sophisticated cyber campaigns earlier with the potential for significant avoided or minimized negative impacts to critical infrastructure or national security, CIRCIA's mandatory reporting requirements reduce the risks associated with those campaigns.

• By facilitating the identification and sharing of information on exploited vulnerabilities and measures that can be taken to address those vulnerabilities, incident reporting enables entities with unremediated and unmitigated vulnerabilities on their systems to take steps to remedy or mitigate those vulnerabilities before they also fall victim to cyberattack.

• By supporting sharing of information about common threat actor tactics, techniques, and procedures with the IT community, cyber incident reporting will enable software developers and vendors to develop more secure products or send out updates to add security to existing products, better protecting end users.

• By enabling rapid identification of ongoing incidents and increased understanding of successful mitigation measures, incident reporting increases the ability of impacted entities and the Federal government to respond to ongoing campaigns faster and mitigate or minimize the consequences that could result from them.

• Law enforcement entities can use the information submitted in reports to investigate, identify, capture, and prosecute perpetrators of cybercrime, getting malicious cyber actors off the street and deterring future actors.

• By contributing to a more accurate and comprehensive understanding of the cyber threat environment, incident reporting allows for CISA's Federal and non-Federal stakeholders to more efficiently and effectively allocate resources to prevent, deter, defend against, respond to, and mitigate significant cyber incidents.

These benefits, which stem from CISA receiving cyber incident and ransom payment reporting for aggregation, analysis, and information sharing, directly contribute to a reduction in economic, health, safety, and security consequences associated with cyber incidents by reducing the number of cyber incidents successfully perpetrated and mitigating the consequences of those cyber incidents that are successful by catching them earlier. It is worth noting that these benefits are not limited to covered entities required to report under CIRCIA, but also inure to entities not subject to CIRCIA's reporting requirements as they too will receive the downstream benefits of enhanced information sharing, more secure technology products, and an ability to better defend their networks based on sector-specific and cross-sector understandings of the threat landscape.

CISA also anticipates qualitative benefits stemming from the data and record preservation requirements of this proposed rule. The preservation of data and records in the aftermath of a covered cyber incident serves a number of critical purposes, such as supporting the ability of analysts and investigators to understand how a cyber incident was perpetrated and by whom.

III. Background and Purpose

A. Legal Authority

On March 15, 2022, the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) was signed into law. See 6 U.S.C. 681-681g; Public Law 117-103, as amended by Public Law 117-263 (Dec. 23, 2022). CIRCIA requires covered entities to report to CISA covered cyber incidents within 72 hours after the covered entity reasonably believes that the covered cyber incident has occurred and ransom payments made in response to a ransomware attack within 24 hours after the ransom payment has been made. 6 U.S.C. 681b(a). Among other benefits, this new authority will enhance CISA's ability to identify trends and track cyber threat activity across the cyber threat landscape beyond the Federal agencies that are already required to report information on certain cyber incidents to CISA pursuant to the FISMA, 44 U.S.C. 3554(b)(7)(C)(ii) and 6 U.S.C. 652(c)(3). CIRCIA requires the Director of CISA to implement these new reporting requirements through rulemaking, by issuing a Notice of Proposed Rulemaking no later than March 15, 2024, and a final rule within 18 months of the NPRM's publication. 6 U.S.C. 681b(b).

CIRCIA also authorizes CISA to request information and engage in administrative enforcement actions to compel a covered entity to disclose information if it has failed to comply with its reporting obligations. 6 U.S.C. 681d. CIRCIA establishes information treatment requirements and restrictions on use, including certain protections against liability and exemptions from public disclosure, for required reports and information submitted to CISA. 6 U.S.C. 681e, 681d(b)(2), 681c(c). CIRCIA also provides for Federal interagency

coordination and sharing of information on cyber incidents, including ransomware attacks, reported to Federal departments and agencies, and covered cyber incidents and ransom payments reported to CISA. 6 U.S.C. 681a(a)(10), (b), 681g.

Although CIRCIA requires CISA to implement new reporting requirements through regulation, CISA's rulemaking authority under CIRCIA does not supersede, abrogate, modify, or otherwise limit any authority to regulate or act with respect to the cybersecurity of an entity vested in any United States Government officer or agency. 6 U.S.C. 681b(h). Therefore, covered entities that are obligated to report covered cyber incidents or ransom payments pursuant to another Federal regulatory requirement, directive, or similar mandate will remain obligated to do so even if the reporting requirements differ from those established by CIRCIA. Where CIRCIA imposes regulatory requirements that may overlap or duplicate other Federal regulatory requirements, CISA is committed to working with other Federal partners to explore options to minimize unnecessary duplication between CIRCIA's reporting requirements and other Federal cyber incident reporting requirements and welcomes public comment regarding options to minimize unnecessary duplication or identification of specific Federal cyber incident reporting requirements where such duplication is likely to occur. Additionally, CIRCIA does not permit or require a provider of a remote computing service or electronic communication service to the public to disclose information not otherwise permitted or required to be disclosed under 18 U.S.C. 2701-2713 (commonly known as the “Stored Communications Act”). 6 U.S.C. 681e(e).

CIRCIA also provides that entities may voluntarily report cyber incidents or ransom payments to CISA that are not required to be reported under the CIRCIA regulations, and applies the same information treatment requirements on use (including liability protections) and restrictions on use to such voluntarily submitted reports. 6 U.S.C. 681c(a), (c); 681e. CISA is not, however, proposing to address entirely voluntary reporting (

e.g.,

how such reports may be submitted) in this rulemaking.

B. Current Cyber Incident Reporting Landscape

The cyber incident reporting landscape currently consists of dozens of Federal and state, local, tribal, or territorial (SLTT) cyber incident reporting requirements that may apply to entities operating within the United States, depending on where an entity or its customers are located and the type of business in which the entity is engaged. At the Federal level alone, more than three dozen different cyber incident reporting requirements currently are in effect, with a number of additional proposed regulatory reporting requirements in various stages of development. At the SLTT level, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, and all 50 states have laws that require reporting and/or public disclosure of at least some cyber incidents that result in data breaches.

Despite these myriad Federal and SLTT reporting requirements, prior to the enactment of CIRCIA, there was no Federal statute or regulation supporting a comprehensive and coordinated approach to understanding cyber incidents across critical infrastructure sectors. Nor was there a Federal department or agency charged with coordinating cross-sector sharing of information related to cyber incidents with Federal and non-Federal stakeholders. Indeed, during the lead up to the passage of CIRCIA, Congress stated “[t]oday no one U.S. Government agency has visibility into all cyber-attacks occurring against U.S. critical infrastructure on a daily basis. This bill would change that—enabling a coordinated, informed U.S. response to the foreign governments and criminal organizations conducting these attacks against the U.S.”

The enactment of CIRCIA authorized CISA to fill these key gaps in the current cyber incident reporting landscape.

U.S. Senate Committee on Homeland Security and Governmental Affairs (HSGAC),

Cyber Incident Reporting for Critical Infrastructure Act

at 1 (Dec. 17, 2021), available at

https://www.hsgac.senate.gov/wp-content/uploads/imo/media/doc/Overview%20of%20Cyber%20Incident%20Reporting%20Legislation.pdf

(hereinafter, “

HSGAC Fact Sheet”

There are a number of different reasons why a government entity may establish cyber incident reporting requirements. A recent DHS report to Congress based on the work of the Cyber Incident Reporting Council (CIRC)

titled

Harmonization of Cyber Incident Reporting to the Federal Government

suggests that these reasons generally can be organized into two primary categories.

The first category consists of regulations primarily focused on national security, economic security, public health and safety, and/or the resiliency of National Critical Functions (NCFs). A majority of Federal reporting regimes appear to be solely or primarily animated by these concerns. The remaining Federal cyber incident reporting regimes, as well as virtually all SLTT cyber incident reporting regimes, are designed primarily to address privacy, consumer protection, or investor protection considerations. This second category includes all the reporting regimes often referred to as data breach notification laws.

CIRCIA established an intergovernmental Cyber Incident Reporting Council. Chaired by the Secretary of Homeland Security, the CIRC is responsible for coordinating, deconflicting, and harmonizing Federal incident reporting requirements, including those issued through regulations. 6 U.S.C. 681f.

Department of Homeland Security,

Harmonization of Cyber Incident Reporting to the Federal Government

at 5 (Sept. 19, 2023), available at

https://www.dhs.gov/publication/harmonization-cyber-incident-reporting-federal-government

(hereinafter, “

the DHS Report”

Outside of state data breach notification laws, most existing cyber incident reporting requirements target specific communities with common characteristics. Some focus on entities within a specific industry or sector (

e.g.,

commercial nuclear power reactors; financial services institutions) while others cover entities across sectors that possess certain shared characteristics (

e.g.,

entities possessing threshold quantities of certain chemicals of interest that render those entities high-risk of being targeted by terrorists; entities located upon navigable bodies of water where they present the risk of a transportation security incident; entities that maintain personal health-related records).

Central aspects of cyber incident reporting regimes, such as what constitutes a reportable incident, the process for reporting an incident, which entity receives the report, what information must be reported, and how long an entity has to report the incident, can vary widely from regime to regime, with the purpose of the regime frequently impacting these variables. For instance, reporting regimes focused on national or economic security tend to have shorter deadlines for reporting than those regimes focused on privacy or consumer protections. Similarly, reporting regimes focused on national or economic security almost universally require reporting to a Federal department or agency, while regimes with a primary purpose of privacy or consumer protections often require reporting to the impacted individual and sometimes credit reporting agencies, instead of, or in addition to, reporting to the governing Federal or SLTT entity.

Given the number and variety of different cyber incident reporting regimes, and their continued evolution,

CISA does not intend to describe each one of them as part of this section. Instead, CISA is providing the following brief summaries of some of the major regulatory programs that require reporting of cyber incidents and that are concerned at least in part with national security, economic security, public safety, and/or the resiliency of NCFs:

Individuals interested in learning more about existing Federal cyber incident reporting requirements are encouraged to review the Federal Cyber Incident Reporting Requirements Inventory contained in Appendix B of the

DHS Report, supra

note 4.

•

Chemical Facility Anti-Terrorism Standards (CFATS).

CISA's CFATS program worked for the prior 16 years to identify and regulate high-risk chemical facilities to ensure security measures are in place to reduce the risk of certain chemicals of interest from being weaponized by terrorists. See 6 CFR part 27. Under CFATS Risk-Based Performance Standard 15, CFATS-covered facilities were expected to establish protocols governing the identification and reporting of significant cyber incidents to the appropriate facility personnel, local law enforcement, and/or CISA. On July 28, 2023, the statutory authority for the CFATS program expired, but CISA anticipates that CFATS will be reauthorized prior to the publication of the CIRCIA Final Rule.

•

Defense Federal Acquisition Regulation Supplement (DFARS).

Pursuant to 32 CFR 236.1-236.7 and 48 CFR 252.204-7012, Department of Defense (DOD) contractors must report to DOD all cyber incidents (1) involving covered defense information on their covered contractor information systems or (2) affecting the contractor's ability to provide operationally critical support. Contractors subject to these requirements, who are members of the Defense Industrial Base sector, must report cyber incidents to DOD at

https://dibnet.dod.mil.

•

Department of Energy (DOE) DOE-417 reporting requirements.

DOE's Office of Cybersecurity, Energy Security, and Emergency Response requires certain Energy Sector entities to report certain cybersecurity incidents to DOE pursuant to 15 U.S.C. 772(b). Entities subject to the reporting requirements include Balancing Authorities, Reliability Coordinators, some Generating Entities, and Electric Utilities, including those located in Puerto Rico, the Virgin Islands, Guam, or other U.S. possessions.

•

Federal Communications Commission's (FCC) Network Outage Reporting System (NORS) Requirements.

Under 47 CFR part 4, providers of telecommunications services and Voice over internet Protocol (VoIP) providers are required to report to the FCC communications service outages, including those caused by cyber incidents, that meet certain minimum requirements for duration and magnitude. The goal of this regulation, which applies to wireline, wireless, VoIP, cable, satellite, Signaling System 7, submarine cable, covered 911 service, and covered 988 service providers, is to provide rapid, complete, and accurate information on service disruptions that could affect homeland security, public health or safety, and the economic well-being of the Nation and help ensure the public's access to emergency services.

•

Federal Information Security Modernization Act of 2014.

FISMA requires Federal civilian departments and agencies to report cybersecurity incidents to CISA within one hour of discovery.

CISA uses information received in FISMA incident reports to, among other things, provide technical assistance to victims of cyber incidents, compile and analyze incident information to identify cyber threats and vulnerabilities, and share guidance with others on how to detect, handle, and prevent similar incidents.

Federal agencies are also required to report major incidents under FISMA and pursuant to OMB Guidance, including those that implicate personal information.

44 U.S.C. 3554(b)(7)(C)(ii).

44 U.S.C. 3556(a).

44 U.S.C. 3554(b)(7)(C)(iii).

•

Federal Risk and Authorization Management Program (FedRAMP).

FedRAMP requires any cloud service providers (CSPs) with a Federal agency-issued Authority to Operate (ATO) or a FedRAMP-issued provisional ATO to report suspected and confirmed information security incidents to the FedRAMP Program Management Office within the General Services Administration (GSA), CISA, and the affected agency.

See

FedRAMP,

GSA,

https://www.gsa.gov/technology/government-it-initiatives/fedramp

(last visited Nov. 27, 2023).

•

Financial Services Sector Regulations.

Most of the primary Financial Services Sector regulators have adopted cyber incident reporting requirements for their regulated communities. Among other things, these reporting requirements have been established to help promote early awareness of emerging threats to banking organizations and the broader financial system, and to help the regulating entities react to these threats before they can cause systemic impacts across the financial system. Included among these are cyber incident reporting requirements managed by the Office of the Comptroller of the Currency (OCC) (12 CFR part 53), the Federal Reserve Board (FRB) (12 CFR part 225), the Federal Deposit Insurance Corporation (FDIC) (12 CFR part 304), the Commodity Futures Trading Commission (CFTC) (see,

e.g.,

17 CFR 38.1051 (designated contract markets); 17 CFR 37.1401 (swap execution facilities); 17 CFR 39.18 (derivatives clearing organizations); 17 CFR 49.24 (swap data repositories); 17 CFR 23.603 (swap dealers)), the National Credit Union Administration (NCUA) (12 CFR part 748), the Securities and Exchange Commission (SEC) (see,

e.g.,

17 CFR parts 229, 232, 239, 240, 242, and 249), and the Federal Housing Finance Agency (FHFA) (Advisory Bulletin 2020-05).

•

Maritime Transportation Security Act (MTSA).

Under MTSA (33 CFR parts 104, 105, or 106) entities that own vessels or facilities, including outer continental shelf facilities, subject to MTSA must report cyber incidents to the U.S. Coast Guard's (USCG) National Response Center. These cyber incident reporting requirements are part of a larger suite of security requirements for vessels and facilities to identify, assess, and prevent transportation security incidents (TSIs) in the marine transportation system. USCG is also in the process of updating its maritime security regulations by adding cybersecurity requirements to existing Maritime Security regulations.

See Office of Management and Budget,

Office of Information and Regulatory Affairs Unified Agenda,

available at

https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202304&RIN=1625-AC77.

•

North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standard CIP-008-6: Cyber Security

—

Incident Reporting and Response Planning.

Certain electric grid entities, designated as “responsible entities,” are required to report cyber incidents to both CISA and the Electricity Information Sharing and Analysis Center (ISAC), a component of NERC. See 18 CFR part 40 and CIP-008-6. The goal of these reporting requirements, which were developed pursuant to the authority granted NERC in Section 215 of the Federal Power Act (16 U.S.C. Ch 12, as amended through Pub. L. 115-325) to develop mandatory and enforceable reliability standards subject to Federal Energy Regulatory Commission (FERC) review and approval, is to mitigate the risk to the reliable operation of the Bulk Electric

System (BES) as the result of a cybersecurity incident.

•

Nuclear Regulatory Commission (NRC) Cyber Security Event Notification Regulation.

Owners and operators of commercial nuclear power reactors are required to report cyber incidents impacting safety, security, or emergency preparedness functions to the NRC.

10 CFR 73.77.

•

The Food and Drug Administration (FDA) Medical Device Regulations.

Under section 519 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 360i), as implemented by the Medical Device Reporting Regulations (21 CFR part 803) and the Medical Device Reports of Corrections and Removals Regulations (21 CFR part 806), manufacturers and importers must report certain device-related adverse events and product problems, including those caused by cyber incidents, to the FDA. For example, medical device manufacturers are required to report to the FDA when they learn that any of their devices may have caused or contributed to a death or serious injury. Manufacturers must also report to the FDA when they become aware that their device has malfunctioned and would be likely to cause or contribute to a death or serious injury if the malfunction were to recur. Medical device manufacturers and importers also must report to FDA any correction or removal of a medical device initiated to reduce a risk to health posed by the device or to remedy a violation of the Federal Food, Drug, and Cosmetic Act, including those caused by cyber incidents, caused by the device that may present a risk to health. A report must be made even if the event was caused by user error.

•

Transportation Security Administration (TSA) Security Directives and Security Program Amendments.

TSA has issued several Security Directives and Security Program Amendments requiring various Transportation Systems Sector entities to report cybersecurity incidents to CISA.

These include, among other provisions, reporting requirements for certain passenger railroad carrier and rail transit systems, hazardous and natural gas pipeline owners and operators, freight railroad carriers, airport operators, aircraft operators, indirect air carriers, and Certified Cargo Screening Facilities. TSA is also in the process of codifying the requirements for surface transportation through a rulemaking (TSA's regulations provide for changes to aircraft operator security programs through an amendment process).

See,

e.g.,

TSA Security Directive Pipeline-2021-01 series,

Enhancing Pipeline Cybersecurity;

TSA Security Directive 1580-21-01 series,

Enhancing Rail Cybersecurity,

available at

https://www.tsa.gov/sd-and-ea.

See Office of Management and Budget,

Office of Information and Regulatory Affairs Unified Agenda,

available at

https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202304&RIN=1652-AA74.

C. Purpose of Regulation

While the legislative history and statutory text shed some light on the goals that Congress hoped to achieve through this regulation, Congress did not include an explicit statement of purpose in CIRCIA. CISA believes considering the specific intended purpose behind a cyber incident reporting regulation during the development of the regulations is important as the purpose likely impacts key aspects of the regulation, such as what entities are required to report, what types of incidents must be reported, how quickly incidents must be reported, what information must be included in incident reports, and to whom the reports must be provided.

Many stakeholders echoed this belief in remarks made during CIRCIA listening sessions or through comments provided in response to the CIRCIA RFI, which encouraged CISA to articulate the goals of the regulation to help inform the best regulatory proposal.

This section of the NPRM is intended to provide insight into what CISA interprets to be the purposes of the regulation that has informed the development of CISA's proposed regulation.

See 87 FR 55833 (Sept. 12, 2022); comments submitted by Information Technology Industry Council, CISA-2022-0010-0097 (“[I]t is vital that CISA articulate its tactical goals and/or plan for actualizing CIRCIA, as only upon understanding what CISA hopes to accomplish with these reports can industry stakeholders provide more specific commentary on key scoping and reporting threshold questions.”); National Grain and Feed Association, CISA-2022-0010-0104 (“CISA should also identify the specific purpose of reporting an incident. For example, if the data will be used by the government for trend identification.”); G. Rattray, CISA-2022-0010-0159 (“[CISA] will have to decide whether it is reporting that serves the purpose of characterizing threats or you're trying to understand risks and vulnerability. Both are probably viable analytically, but those would lead to different sort of reporting requirements.”).

i. Purposes of the CIRCIA Regulation

CIRCIA's legislative history indicates that the primary purpose of CIRCIA is to help preserve national security, economic security, and public health and safety. For example, in December 2021, HSGAC issued a fact sheet on the proposed legislation acknowledging the “serious national security threat” posed by cyberattacks and stating that CIRCIA would help enable a coordinated, informed U.S. response to the foreign governments and criminal organizations conducting these attacks against the United States.

Similarly, the U.S. House Committee on Homeland Security (CHS) issued a fact sheet on the proposed legislation stating that CIRCIA would provide CISA and its Federal partners the visibility needed to bolster cybersecurity, identify malicious cyber campaigns in early stages, identify longer-term threat trends, and ensure actionable cyber threat intelligence is getting to the first responders and Federal officials who need it.

HSGAC Fact Sheet, supra

note 2, at 1.

CHS,

The Cyber Incident Reporting for Critical Infrastructure Act

at 1, 3 (Aug. 2021), available at

https://democrats-homeland.house.gov/download/incident-reporting-bill-draft-fact-sheet

(hereinafter, “

CHS Fact Sheet”

The plain language that Congress used throughout CIRCIA reflects the purpose discussed in CIRCIA's legislative history. For example, CIRCIA requires CISA to review covered cyber incidents that are “likely to result in demonstrable harm to the national security interests, foreign relations, or economy of the United States or to the public confidence, civil liberties, or public health and safety of the people of the United States” and to “identify and disseminate ways to prevent or mitigate similar incidents in the future.” 6 U.S.C. 681(9); 6 U.S.C. 681a(a)(6). CIRCIA also requires CISA to “assess potential impact of cyber incidents on public health and safety,” and to consider, when describing covered entities, both “the consequences that disruption to or compromise of [a covered entity] could cause to national security, economic security, or public health and safety” and “the extent to which damage, disruption, or unauthorized access to such an entity . . . will likely enable the disruption of the reliable operation of critical infrastructure.” 6 U.S.C. 681a(a)(1); 6 U.S.C. 681b(c)(1)(A), 681b(c)(1)(C).

Both CIRCIA's legislative history and statutory text highlight a number of more discrete purposes within the broader goals of enhancing national and economic security, and public health and safety. Some examples of these purposes include trend and threat analysis (

i.e.,

the performance of cybersecurity threat and incident trend analysis and tracking, to include the analysis and identification of adversary tactics, techniques, and procedures (TTPs));

vulnerability and mitigation

assessment (

i.e.,

the identification of cyber vulnerabilities and the assessment of countermeasures that might be available to address them);

the provision of early warnings (

i.e.,

the rapid sharing of information on cyber threats, vulnerabilities, and countermeasures through the issuance of cybersecurity alerts or other means);

incident response and mitigation (

i.e.,

rapid identification of significant cybersecurity incidents and offering of assistance—

e.g.,

personnel, services—in incident response, mitigation, or recovery);

supporting Federal efforts to disrupt threat actors;

and advancing cyber resiliency (

i.e.,

developing and sharing strategies for improving overall cybersecurity resilience; facilitating use of cyber incident data to further cybersecurity research; engagement with software/equipment manufacturers on vulnerabilities and how to close them).

See,

e.g., id.

at 3;

Stakeholder Perspectives on the Cyber Incident Reporting for Critical Infrastructure Act of 2021 Before the Subcomm. on Cybersecurity, Infrastructure Protection, and Innovation of the H. Comm. on Homeland Security,

117th Cong. 64 (2021), available at

https://www.congress.gov/event/117th-congress/house-event/114018/text

(hereinafter, “

Stakeholder Perspectives Hearing”

) (statement of Rep. Yvette Clarke) (“One of the goals in drafting this legislation was to provide CISA with enough information to analyze and understand threats . . . .”); 6 U.S.C. 681a(a)(1) (CISA must aggregate and analyze reports to identify TTPs adversaries use and to enhance situational awareness of cyber threats across critical infrastructure sectors).

See,

e.g., Responding to and Learning from the Log4Shell Vulnerability Before the S. Comm. on Homeland Security and Governmental Affairs,

117th Cong. 2 (2022) (statement of Sen. Gary Peters, Chairman, S. Comm. on Homeland Security and Governmental Affairs), available at

https://www.hsgac.senate.gov/hearings/responding-to-and-learning-from-the-log4shell-vulnerability/

(hereinafter, “

Log4Shell Vulnerability Hearing Peters Statement”

) (“This legislation will help our lead cybersecurity agency better understand the scope of attacks, including from vulnerabilities like Log4j. . . .”); 6 U.S.C. 681a(a)(1) (CISA must aggregate and analyze reports to assess the effectiveness of security controls).

See,

e.g., Log4Shell Vulnerability Hearing Peters Statement, supra

note 18, at 2 (“This legislation will help our lead cybersecurity agency . . . warn others of the threat, prepare for potential impacts. . . .”); Minority Staff of S. Comm. on Homeland Security and Governmental Affairs, 117th Cong., America's Data Held Hostage: Case Studies in Ransomware Attacks on American Companies vi (Comm. Print 2022), available at

https://www.hsgac.senate.gov/library/files/americas-data-held-hostage-case-studies-in-ransomware-attacks-on-american-companies/

(“This legislation will enhance the Federal Government's ability to combat cyberattacks, mount a coordinated defense, hold perpetrators accountable, and prevent and mitigate future attacks through the sharing of timely and actionable threat information.”); 6 U.S.C. 681a(a)(3)(B) (CISA must provide entities with timely, actionable, and anonymized reports of cyber incident campaigns and trends, including, to the maximum extent practicable, cyber threat indicators and defensive measures); 6 U.S.C. 681a(a)(5)-(7) (CISA must identify and disseminate ways to prevent or mitigate cyber incidents, and must review reports for cyber threat indicators that can be anonymized and disseminated, with defensive measures, to stakeholders).

See,

e.g., HSGAC Fact Sheet,

supra

note 2, at 1 (“This information will allow CISA to provide additional assistance to avoid cyber-attacks against our critical infrastructure, like the attacks on Colonial Pipeline and JBS Foods.”);

Log4Shell Vulnerability Hearing Peters Statement, supra

note 18 (“This legislation will help our lead cybersecurity agency . . . help affected entities respond and recover.”).

See,

e.g.,

Press Release, S. Comm. on Homeland Security and Governmental Affairs,

Portman, Peters Introduce Bipartisan Legislation Requiring Critical Infrastructure Entities to Report Cyberattacks

(Sept. 28, 2021), available at

https://www.hsgac.senate.gov/media/dems/peters-and-portman-introduce-bipartisan-legislation-requiring-critical-infrastructure-entities-to-report-cyber-attacks/

(“As cyber and ransomware attacks continue to increase, the federal government must be able to quickly coordinate a response and hold these bad actors accountable.”); Letter from Sen. Rob Portman, Ranking Member, S. Comm. on Homeland Security and Governmental Affairs, to Vanessa Countryman, Secretary, SEC, Re: RE: SEC Proposed Rule on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, File No. S7-09-22, 3 (May 9, 2022), available at

https://www.sec.gov/comments/s7-09-22/s70922-20128391-291294.pdf

(“When considering the legislation, Congress noted if the FBI is `provided information from reports under the process outlined in the statute, [it] may, as appropriate, use information contained in the reports and derived from them' for a range of investigatory activities. This is consistent with the statute which states incident reports can be used for `the purpose [of] preventing, investigating, disrupting, or prosecuting an offense arising out of a cyber incident' reported under the law. This allows law enforcement agencies to disrupt and deter hostile cyber actors. . . .” (footnotes omitted)).

See,

e.g.,

6 U.S.C. 681a(a)(9) (CISA must proactively identify opportunities to leverage and utilize data on cyber incidents to enable and strengthen cybersecurity research carried out by academia and private sector organizations).

ii. How the Regulatory Purpose of CIRCIA Influenced the Design of the Proposed CIRCIA Regulation

Based on CISA's understanding of the purposes of CIRCIA, CISA identified two fundamental principles that influenced the design of the proposed CIRCIA regulation in key areas. First, to achieve many of the desired goals of the proposed regulation—such as conducting analysis to identify adversary TTPs and providing early warnings to enhance situational awareness of cyber threats across critical infrastructure sectors—CISA needs to receive a sufficient quantity of Covered Cyber Incident Reports and Ransom Payment Reports from across the spectrum of critical infrastructure. As noted by the Cyberspace Solarium Commission, the government's cyber incident situational awareness, its ability to detect coordinated cyber campaigns, and its cyber risk identification and assessment efforts rely on comprehensive data and, prior to the passage of CIRCIA, the Federal government lacked a mandate to systematically collect cyber incident information reliably and at the scale necessary.

Sufficient data also is central to being able to differentiate campaigns from isolated incidents and support the development of more generalizable conclusions.

Cyberspace Solarium Commission,

Cyberspace Solarium Commission Report

at 103 (Mar. 2020), available at

https://cybersolarium.org/march-2020-csc-report/march-2020-csc-report/

(hereinafter “

Cyberspace Solarium Commission Report”

); see also Sandra Schmitz-Berndt, “Defining the Reporting Threshold for a Cybersecurity Incident under the NIS Directive and the NIS 2 Directive,”

Journal of Cybersecurity

at 2 (Apr. 5, 2023) (“[L]ow reporting levels result in a flawed picture of the threat landscape, which in turn may impact cybersecurity preparedness.”), available at

https://academic.oup.com/cybersecurity/article/9/1/tyad009/7160387.

See,

e.g.,

CISA,

Cost of a Cyber Incident: Systematic Review and Cross-Validation

at 49 (Oct. 26, 2020) (reliance on limited data sources such as those based on convenience samples “means that no statistical representativeness can be claimed [which] limits the ability to support inference for generalizing results beyond the studied samples.”), available at

https://www.cisa.gov/resources-tools/resources/cost-cyber-incident-systematic-review-and-cross-validation.

If CISA designs the proposed regulations in a way that overly limits the quantity and variety of reports it receives from across critical infrastructure sectors, CISA will lack sufficient information to support reliable trend analysis, vulnerability identification, provision of early warnings, and other key purposes of the proposed regulation as indicated by CIRCIA. This fundamental principle was particularly important for CISA as it considered different options related to which entities should be required to report, what types of cyber incidents should be reported, and the scope and amount of technical detail necessary in CIRCIA Reports to enable CISA to conduct threat analysis, track campaigns, and provide early warnings as required by CIRCIA.

Many stakeholders provided comments in response to the RFI issued in September 2022 cautioning CISA that collecting too many reports could result in data overload and hinder CISA's ability to identify important trends and vulnerabilities. While CISA agrees that there could be some point at which the number of reports submitted begins to yield diminishing marginal returns, CISA believes that, due to advances in technology and strategies for managing large data sets, the potential challenges associated with receiving large volumes of reports can be mitigated through technological and procedural strategies. Additionally, as discussed in Section IV.E.ii in this document, CISA proposes to design the reporting form in a manner that is easy for a covered entity or third-party submitter to complete, encourages the submission of useful information,

and provides information to CISA in a manner that facilitates analysis and review. As a result, CISA is less concerned about receiving too many reports and more concerned about not receiving enough reports to support the intended regulatory purposes of the CIRCIA regulations. As noted by Microsoft President Brad Smith during his testimony in front of the U.S. Senate Select Committee on Intelligence during a hearing on the “Hack of U.S. Networks by a Foreign Adversary,” in the wake of the supply chain compromise of the SolarWinds Orion product, “one of the challenges in this space is the nature of all threat intelligence, whether it's cyber-based or physically based, is that it's always about connecting dots. So the more dots you have, the more likely you are to see a pattern and reach a conclusion. . . . And then they're spread out across different parts of the public sector as well. So this notion of aggregating them is key.”

Testimony of Brad Smith to the U.S. Senate Select Committee on Intelligence, “Hearing on Hack of U.S. Networks by a Foreign Adversary” (Feb. 23, 2021), available at

https://www.intelligence.senate.gov/hearings/open-hearing-hearing-hack-us-networks-foreign-adversary.

CISA is cognizant of the fact that reporting does not come without costs, however, so CISA is not seeking simply to capture the maximum number of reports possible under the statutory language (

i.e.,

by scoping both the applicability of the rule and covered cyber incidents as broadly as legally permissible). CISA's goal is to identify and achieve the proper balance among the number of reports being submitted, the benefits resulting from their submission, and the costs to both the reporting entities and the government of the submission, analysis, and storage of those reports.

The second major principle CISA identified that influenced aspects of the proposed regulation was the importance of timeliness in both the receipt of reports and in CISA's ability to analyze and share information gleaned from those reports. To achieve the very important early visibility and warning aspects of this regulatory regime and increase the likelihood that entities across the critical infrastructure community will be able to address identified vulnerabilities and secure themselves against the latest adversary TTPs before falling victim to them, time is of the essence. CISA kept this second principle in mind as CISA considered options for when a covered entity's reporting obligations begin under the proposed regulation and the manner, form, and procedures for reporting.

Similar to the first principle, CISA recognizes that potential drawbacks to overprioritizing timely reporting exist, such as potentially impacting a covered entity's ability to conduct preliminary incident response and mitigation. CISA also recognizes that a covered entity may not have all the information in the early aftermath of incident discovery, and that some preliminary determinations made at the outset of an incident response process may later be determined to be inaccurate when the entity is afforded time to conduct further investigation and analysis. Accordingly, CISA has sought to balance the critical need for timely reporting with the potential challenges associated with rapid reporting in the aftermath of a covered cyber incident. For example, CISA recognizes that covered entities may require some limited time to conduct preliminary analysis before establishing a reasonable belief that a covered cyber incident has occurred and thereby triggering the 72-hour timeframe for reporting. See Section IV.E.iv.1 in this document. Additionally, to the extent that information that is required to be reported under the regulation is evolving or unknown within the initial reporting deadline for a covered cyber incident, CISA is proposing to allow covered entities to submit new or updated information in a Supplemental Report as additional information becomes known about the covered cyber incident. See Section IV.E.iii.4 in this document.

D. Harmonization Efforts

Given the number of existing cyber incident reporting requirements at the Federal and SLTT levels, CISA recognizes that covered entities may be subject to multiple, potentially duplicative requirements to report cyber incidents. In an attempt to minimize the burden on covered entities potentially subject to both CIRCIA and other Federal cyber incident reporting requirements, CISA is committed to exploring ways to harmonize this regulation with other existing Federal reporting regimes, where practicable and seeks comment from the public on how it can further achieve this goal. CISA is already engaged in several efforts in furtherance of harmonization of cyber incident reporting, including: (1) serving as a member of the CIRC and participating in the CIRC's efforts to coordinate, deconflict, and harmonize Federal cyber incident reporting requirements; (2) participating in the Cybersecurity Forum for Independent and Executive Branch Regulators; (3) performing extensive outreach with Federal and non-Federal entities to gain a fulsome understanding of the existing cyber incident reporting regulatory landscape and gather perspectives on how to harmonize existing cyber incident reporting requirements; and (4) engaging with other Federal departments and agencies that implement cyber incident reporting requirements to determine whether covered entities could potentially take advantage of the proposed substantially similar reporting exception to CIRCIA reporting (discussed further in Section IV.D.i in this document).

CISA actively participated in the CIRC to help identify potential approaches to harmonizing Federal cyber incident reporting requirements and to support the identification of recommended practices that could be considered by CISA and other Federal departments and agencies as they develop or update their respective cyber incident reporting regimes. Specifically, CISA participated in various DHS-led working groups to identify potential recommended practices and areas of harmonization related to Federal cyber incident reporting requirements, many of which are reflected in the DHS Report.

CISA considered the DHS Report and its recommendations as it developed this proposed rule and attempted to leverage the model definition and reporting form recommended in the DHS Report to the extent practicable and consistent with the unique regulatory authority granted to CISA under CIRCIA and the purpose of the CIRCIA regulation (described in Sections III.A and C in this document).

DHS Report, supra

note 4, at 5.

CISA has also been an active participant in the Cybersecurity Forum for Independent and Executive Branch Regulators. The goal of this forum, which was initially launched in 2014, is to increase the overall effectiveness and consistency of Federal regulatory authorities related to cybersecurity by enhancing communication among regulatory agencies, sharing best practices, and exploring ways to align, leverage, and deconflict approaches to cybersecurity regulation.

Current participants in the Forum include, among others, FCC, CISA, CFTC, Consumer Product Safety Commission, Department of Health and Human Services (HHS), DHS, Department of the Treasury, FERC, FHFA, FRB, Federal Trade Commission, FDA, NRC, OCC, SEC, TSA, USCG, and the Office of the National Cyber Director.

See Cybersecurity Forum for Independent and Executive Branch Regulators Charter (2014), available at

https://www.nrc.gov/docs/ML1501/ML15014A296.pdf.

Additionally, CISA has performed, and as required by CIRCIA, plans on continuing to perform, outreach to both Federal partners and non-Federal stakeholders to learn about existing and proposed cyber incident reporting regulations and ways in which CISA may be able to design and implement the CIRCIA requirements to harmonize with those reporting requirements to the extent practicable. In addition to the RFI and listening sessions described in Section III.F in this document, CISA held a series of consultations with each Sector Risk Management Agency (SRMA), all Federal departments and agencies that currently oversee cyber incident reporting requirements, and various other Federal departments and agencies with equities in cyber incident and ransom payment reporting. During these engagements, CISA has sought to learn about existing and proposed Federal regimes that require the reporting of cyber incidents or ransom payments and discuss areas where CISA and its Federal counterparts might want to, and be able to, harmonize their respective reporting requirements. CISA leveraged the information gained via the RFI, listening sessions, and Federal consultations in the development of this NPRM, and intends to continue to engage Federal partners during the development and implementation of the final rule in an attempt to harmonize reporting requirements and reduce the burden on potential covered entities, where practicable.

Finally, CISA intends to work with other Federal departments and agencies to explore opportunities to reduce duplicative reporting of covered cyber incidents through a proposed substantially similar reporting exception to CIRCIA. Under this exception, which is authorized under 6 U.S.C. 681b(a)(5)(B), a covered entity that is required by law, regulation, or contract to report information to another Federal entity that is substantially similar to the information that must be reported under CIRCIA and is required to submit the report in a substantially similar timeframe to CIRCIA's reporting deadlines, may be excepted from reporting it again under CIRCIA. Per the statute, for covered entities to be able to leverage this specific exception, CISA and the respective Federal entity must enter into an interagency agreement, referred to as a CIRCIA Agreement, and establish an information sharing mechanism to share reports. To the extent practicable, CISA is committed to working in good faith with its Federal partners to have CIRCIA Agreements finalized before the effective date of the final rule. Additional details on the substantially similar reporting exception to CIRCIA are discussed in Section IV.D.i in this document.

CISA welcomes all comments on all aspects of harmonizing CIRCIA's regulatory reporting requirements with other cyber incident and ransom payment reporting requirements, including:

1. Potential approaches to harmonizing CIRCIA's regulatory reporting requirements with other existing Federal or SLTT laws, regulations, directives, or similar policies that require reporting of cyber incidents or ransom payments.

2. How to reduce actual, likely, or potential duplication or conflict between other Federal or SLTT laws, regulations, directives, or policies and CIRCIA's reporting requirements.

E. Information Sharing Required by CIRCIA

Sharing information on cyber incidents, ransomware attacks, and the broader cyber threat landscape is central to CIRCIA. In fact, CIRCIA imposes several requirements upon CISA and other Federal departments and agencies related to the sharing of information received through cyber incident and ransom payment reporting programs, including the CIRCIA proposed regulations. As Congress imposed these obligations solely on Federal departments and agencies, they are not included in the CIRCIA proposed rule; however, information sharing will be an integral part of the overall CIRCIA implementation, and CISA is committed to working with its Federal partners to share cyber threat information across the Federal government and, as appropriate, with non-Federal stakeholders.

As required by 6 U.S.C. 681a(a)(10) and (b), CISA will make information received via CIRCIA Reports or in response to an RFI or subpoena available to appropriate SRMAs and other appropriate Federal departments and agencies, as determined by the President or a designee of the President, within 24 hours of receipt. CIRCIA also includes a reciprocal requirement, where any Federal department or agency that receives a report of a cyber incident shall provide the report to CISA within 24 hours of receiving the report. See 6 U.S.C. 681g(a)(1). Upon receipt of a report from another Federal agency pursuant to this requirement, CISA must share the report with other Federal agencies as it would any other report submitted to CISA under CIRCIA. 6 U.S.C. 681a(a)(10), 681a(b), 681g(a)(1). In addition to any otherwise generally applicable laws (such as the Privacy Act of 1974

and the E-Government Act of 2002

), pursuant to 6 U.S.C. 681g(a)(3), CISA must protect the reports it receives from Federal partners under these provisions in accordance with any privacy, confidentiality, or information security requirements imposed upon the originating Federal department or agency. CIRCIA also requires CISA to “coordinate and share information with appropriate Federal departments and agencies to identify and track ransom payments.” 6 U.S.C. 681a(a)(2).

See 5 U.S.C. 552a.

See 44 U.S.C. 3501 note, Public Law 107-347.

CIRCIA imposes requirements on CISA related to sharing cyber threat information with non-Federal stakeholders as well. For example, 6 U.S.C. 681a(a)(7) requires CISA to immediately review Covered Cyber Incident Reports or voluntary reports submitted to CISA pursuant to 6 U.S.C. 681c to the extent they involve ongoing cyber threats or security vulnerabilities for cyber threat indicators that can be anonymized and disseminated, with defensive measures, to appropriate stakeholders. Similarly, for a covered cyber incident or group of covered cyber incidents that satisfies the definition of a significant cyber incident, CISA must conduct a review of the details surrounding the incident(s) and identify and disseminate ways to prevent or mitigate similar incidents in the future. 6 U.S.C. 681a(a)(6). CISA must also “publish quarterly unclassified, public reports that describe aggregated, anonymized observations, findings, and recommendations” based on Covered Cyber Incident Reports. 6 U.S.C. 681a(a)(8). In addition to limiting sharing of information as may otherwise be required by laws that are generally applicable to information received by the Federal government, such as the Trade Secrets Act,

when sharing with critical infrastructure owners and operators and the general public any information received via CIRCIA Reports or responses to RFIs, CISA must anonymize information related to the victim who reported the incident. See 6 U.S.C. 681e(d).

18 U.S.C. 1905.

F. Summary of Stakeholder Comments

While developing this NPRM, CISA sought feedback from an array of public and private sector stakeholders in an effort to identify the most effective potential approach to implementing CIRCIA's reporting requirements. CISA published an RFI in the

Federal

;

held in-person, public listening sessions around the country;

conducted virtual, sector-specific listening sessions;

and consulted with SRMAs and other relevant Federal departments and agencies, all with the goal of receiving meaningful input from entities that will potentially be impacted by this regulation. CISA has considered this feedback when developing the proposals set forth in this NPRM. A summary of the most salient points received in response to the RFI and during the CIRCIA listening sessions follows. All comments received in response to the RFI, as well as transcripts from all the public and sector-specific listening sessions, are available in the electronic docket for this rulemaking.

The RFI, which was published in the

Federal Register

on September 12, 2022, solicited inputs on potential aspects of the proposed regulation prior to the publication of this NPRM. CISA did not limit the type of feedback commenters could submit in response to the RFI, but did specifically request comments on definitions for and interpretations of the terminology to be used in the proposed regulation; the form, manner, content, and procedures for submission of reports required under CIRCIA; information regarding other incident reporting requirements including the requirement to report a description of the vulnerabilities exploited; and other policies and procedures, such as enforcement procedures and information protection policies, that will be required for implementation of the regulation. The comment period was open through November 14, 2022, and CISA received 131 individual comments in response to the RFI. 87 FR 55833.

Between September 21, 2022, and November 16, 2022, CISA hosted ten listening sessions in Salt Lake City, Utah; Chicago, Illinois; Fort Worth, Texas; New York, New York; Philadelphia, Pennsylvania; Washington, DC; Oakland, California; Boston, Massachusetts; Seattle, Washington; and Kansas City, Missouri. 87 FR 55830; 87 FR 60409.

Because CIRCIA defines covered entities with reference to critical infrastructure sectors, CISA held sector-specific listening sessions for each of the 16 critical infrastructure sectors identified in Presidential Policy Directive 21, see

https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors,

as well as a separate session for the Aviation Subsector. Transcripts from these sessions can be viewed in the docket for this rulemaking by going to

www.regulations.gov

and searching for CISA-2022-0010.

i. General Comments

In general, several commenters told CISA that the regulations should be easy to comply with, such that individuals who are not cybersecurity professionals can complete the required reporting, and avoid overly burdensome requirements.

Commenters recommended that compliance with the regulation be incentive-based and supportive, rather than punitive,

and commenters also expressed concerns about the confidentiality of reported information.

Commenters also urged CISA to consider the landscape of existing cyber incident reporting requirements and expressed general concern about the potential negative impacts of unharmonized, complex, and duplicative reporting regimes.

See,

e.g.,

Comments submitted by the Confidentiality Coalition, CISA-2022-0010-0030; Credit Union National Association, CISA-2022-0010-0050; SAP, CISA-2022-0010-0114; Federation of American Hospitals, CISA-2022-0010-0063; Epic, CISA-2022-0010-0090.

See,

e.g.,

Comments submitted by the Arizona Cyber Threat Response Alliance and Arizona Technical Council, CISA-2022-0010-0022; SolarWinds, CISA-2022-0010-0027.

See,

e.g.,

Comments submitted by Google Cloud, CISA-2022-0010-0109; Tenable, CISA-2022-0010-0032; NCTA—The Internet & Television Association, CISA-2022-0010-0102.

See,

e.g.,

Comments submitted by CTIA, CISA-2022-0010-0070; R Street Institute, CISA-2022-0010-0125; IBM, CISA-2022-0010-0069; Cybersecurity Coalition, CISA-2022-0010-0105.

ii. Comments on the Definition of Covered Entity

Several commenters provided suggestions on how to define the term covered entity under this regulation. While some commenters thought the definition of covered entity was straightforward and already understood,

others pointed to different criteria or frameworks CISA could use to scope the definition more effectively. These included, among others, a size-based threshold,

a risk-based approach,

or a focus on the degree to which an entity supported a NCF.

Commenters also suggested leveraging existing lists, standards, or definitions, such as the list of critical infrastructure “where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security,” as determined pursuant to Section 9(a) of Executive Order 13636;

the NERC CIP standard;

the National Institute of Standards and Technology's (NIST's) definition;

or definitions used by other countries.

Others suggested considering the unique qualities of particular industries and sectors and either creating sector-based definitions or excluding certain sectors and industries from the definition altogether.

See,

e.g.,

Comment submitted by the Arizona Cyber Threat Response Alliance and Arizona Technical Council, CISA-2022-0010-0022.

See,

e.g.,

Comments submitted by the Computing Technology Industry Association, CISA-2022-0010-0122; BlackBerry Corporation, CISA-2022-0010-0036; Cyber Threat Alliance, CISA-2022-0010-0019; SolarWinds, CISA-2022-0010-0027.

See,

e.g.,

Comments submitted by the Information Technology Industry Council, CISA-2022-0010-0097; U.S. Chamber of Commerce, CISA-2022-0010-0075; American Property Casualty Insurance Association, CISA-2022-0010-0064.

See,

e.g.,

Comment submitted by Mitchell Berger, CISA-2022-0010-0004

See,

e.g.,

Comments submitted by the UnityPoint Health, CISA-2022-0010-0107; National Retail Federation, CISA-2022-0010-0092; National Rural Electric Cooperative Association, CISA-2022-0010-0025.

See,

e.g.,

Comment submitted by the Powder River Energy Corporation, CISA-2022-0010-0099.

See,

e.g.,

Comment submitted by the Credit Union National Association, CISA-2022-0010-0050.

See,

e.g.,

Comment submitted by SAP, CISA-2022-0010-0114.

See,

e.g.,

Comments submitted by the Rural Wireless Association, Inc., CISA-2022-0010-0093 (recommending excluding small telecommunications carriers); TechNet, CISA-2022-0010-0072 (discussing the “innovation economy”); American Property Casualty Insurance Association, CISA-2022-0010-0064 (recommending exclusion of insurance agencies); NAFCU, CISA-2022-0010-0076 (recommending exclusion of the credit union industry).

iii. Comments on the Definition of Covered Cyber Incident and Substantial Cyber Incident

Many commenters provided thoughts on how to define covered cyber incident and substantial cyber incident, including some who offered their own definitions for CISA to consider.

Multiple commenters indicated a desire for a high threshold for reporting to minimize burdens on regulated entities, avoid duplicative reporting, and prevent CISA from being inundated with reports,

although at least one commenter noted that a narrow definition could leave CISA with an incomplete understanding of the threat landscape.

In recommending high thresholds, commenters suggested that CISA could bound the definition of covered cyber incident in a variety of ways, such as by limiting reporting to “confirmed incidents”;

incidents that cause “actual harm”;

only incidents that impact business operations;

only

incidents that impact an entity's critical infrastructure functions;

incidents that directly impact U.S. companies, citizens, economies or national security;

and/or those resulting only from malicious intent.

Several commenters also advocated for considering definitions that already exist, such as the definition created by NIST that is used in FISMA,

or definitions that are already used among the 16 critical infrastructure sectors.

See,

e.g.,

Comments submitted by the Cybersecurity Coalition, CISA-2022-0010-0105; Microsoft Corporation, CISA-2022-0010-0058.

See,

e.g.,

Comments submitted by The Associations: BPI, ABA, IIB, SIFMA, CISA-2022-0010-0046; American Council of Life Insurers, CISA-2022-0010-0095; UnityPoint Health, CISA-2022-0010-0107; Cloudflare, Inc., CISA-2022-0010-0074; American Property Casualty Insurance Association, CISA-2022-0010-0064; Jim Wollbrinck, CISA-2022-0010-0151.

See,

e.g.,

Comment submitted by NERC, CISA-2022-0010-0049.

See,

e.g.,

Comments submitted by Mandiant, CISA-2022-0010-0120; Edison Electric Institute, CISA-2022-0010-0079; Connected Health Initiative, CISA-2022-0010-0130; ACT | The App Association, CISA-2022-0010-0129.

See,

e.g.,

Comments submitted by the internet Infrastructure Coalition, CISA-2022-0010-0055; Independent Community Bankers of America, CISA-2022-0010-0080; Institute of International Finance, CISA-2022-0010-0060.

See,

e.g.,

Comments submitted by IBM, CISA-2022-0010-0069; Edison Electric Institute, CISA-

2022-0010-0079; Fidelity National Information Services, CISA-2022-0010-0033; National Technology Security Coalition, CISA-2022-0010-0061.

See,

e.g.,

Comments submitted by IBM, CISA-2022-0010-0069; CrowdStrike, CISA-2022-0010-0128; Microsoft Corporation, CISA-2022-0010-0058; Professional Services Council, CISA-2022-0010-0044; Alliance for Automotive Innovation (Auto Innovators), CISA-2022-0010-0082; Telecommunications Industry Association, CISA-2022-0010-0132.

See,

e.g.,

Comments submitted by Airlines for America, CISA-2022-0010-0066; U.S. Chamber of Commerce, CISA-2022-0010-0075; Express Association of America, CISA-2022-0010-0038; The Associations: AFPM, AGA, API, APGA, INGAA, LEPA, CISA-2022-0010-0057.

See,

e.g.,

Comments submitted by Cloudflare, Inc., CISA-2022-0010-0074; The Associations: BPI, ABA, IIB, SIFMA, CISA-2022-0010-0046; internet Infrastructure Coalition, CISA-2022-0010-0055.

See,

e.g.,

Comments submitted by the National Technology Security Coalition, CISA-2022-0010-0061; The Associations: BPI, ABA, IIB, SIFMA, CISA-2022-0010-0046; Mandiant, CISA-2022-0010-0120; Glenn Herdrich, CISA-2022-0010-0158.

See,

e.g.,

Comments submitted by NCTA—The Internet & Television Association, CISA-2022-0010-0102 (generally advocating for a sector-based approach to the definition); Financial Services Sector Coordinating Council, CISA-2022-0010-0094; The Associations: BPI, ABA, IIB, SIFMA, CISA-2022-0010-0046; The Clearing House, CISA-2022-0010-0086 (advocating for alignment with the FDIC's Computer-Security Incident Notification Rule); HIMSS Electronic Health Record Association, CISA-2022-0010-0040 (advocating for alignment with the Health Insurance Portability and Accountability Act requirements); Nuclear Energy Institute, CISA-2022-0010-0029; Rich Mogavero, CISA-2022-0010-0139 (advocating alignment with the definition used by the NRC); Electric Power Supply Association, CISA-2022-0010-0045; Edison Electric Institute, CISA-2022-0010-0079 (advocating for alignment with the reporting standards used by the NERC); NTCA—The Rural Broadband Association, CISA-2022-0010-0100 (recommending consideration of the FCC's reporting requirements in developing the definition).

Comments received on the potential definition of substantial cyber incident echoed those received on the potential definition of covered cyber incident, though a few commenters noted that the term substantial cyber incident does not have existing legal definitions as does covered cyber incident.

One commenter noted that CISA should clarify whether “substantial cyber incidents” are separate from “covered cyber incidents,”

and another commenter recommended covered cyber incidents and substantial cyber incidents should be synonymous terms.

See,

e.g.,

Comments submitted by the Association of Metropolitan Water Agencies, CISA-2022-0010-0088; U.S. Chamber of Commerce, CISA-2022-0010-0075; Fidelity National Information Services, CISA-2022-0010-0033.

See,

e.g.,

Comment submitted by the Professional Services Council, CISA-2022-0010-0044.

See,

e.g.,

Comment submitted by Gideon Rasmussen, CISA-2022-0010-0011.

iv. Comments on Other Definitions

CISA received a small number of comments on other definitions. A few commenters provided feedback on the meaning of the terms ransom payment and ransomware attack, with several noting that the definitions of ransom payment and ransomware attack were understood as defined in CIRCIA and recommending no changes to these terms in the regulation.

See,

e.g.,

Comments submitted by (ISC)2, CISA-2022-0010-0112; Exelon Corp., CISA-2022-0010-0043; SAP, CISA-2022-0010-0114.

A few commenters offered input on the meaning of supply chain compromise, with those who did often acknowledging the statutory definition of the term (see 6 U.S.C. 650(28)),

and recommending that CISA align this term as closely as possible with similar, existing terms, such as “supply chain attack” used by NIST or the definition of “supply chain compromise” used by MITRE.

Several commenters emphasized a need for clarity regarding when a customer or end user would be expected to report on an incident caused somewhere above them in the supply chain, noting that in many cases the impacted covered entity may have limited visibility into what happened along the supply chain to cause the incident.

See,

e.g.,

Comment submitted by the Cybersecurity Coalition, CISA-2022-0010-0105.

See

id.;

see,

e.g.,

Comment submitted by the Information Technology Industry Council, CISA-2022-0010-0097.

See,

e.g.,

Comments submitted by the American Water Works Association, CISA-2022-0010-0127; Edison Electric Institute, CISA-2022-0010-0079; NCTA—The Internet & Television Association, CISA-2022-0010-0102; Exelon Corp., CISA-2022-0010-0043.

v. Comments on Criteria for Determining Whether the Domain Name System Exception Applies

The few comments received relating to whether an entity is a multi-stakeholder organization that develops, implements, and enforces policies concerning the DNS reflected different views. One commenter recommended that CISA clarify that domain name registries and registrars are “governed by a multistakeholder organization.”

Another commenter opined that it would not be appropriate to exempt domain name registrars. The same commenter recommended that CISA identify exempted organizations by name in the final rule, listing Internet Corporation for Assigned Names and Numbers (ICANN) and the Regional Internet Registries for consideration.

Comment submitted by the Internet Infrastructure Coalition, CISA-2022-0010-0055.

See Comment submitted by the Energy Transfer LP, CISA-2022-0010-0037. Regional Internet Registries include ARIN, LACNIC, RIPE NCC, AFRINIC, and APNIC (see Regional Internet Registries | The Number Resource Organization (

nro.net

)).

vi. Comments on Manner and Form of Reporting, Content of Reports, and Reporting Procedures

Numerous commenters provided recommendations on the manner and form of reporting, with many of those concurring with the use of a web-based form for reporting or other means of electronic reporting.

Some explicitly recommended that CISA make a mobile application or otherwise make the form available via a mobile device as well.

Several commenters recommended alternative or additional methods of reporting to include phone or email.

Multiple commenters emphasized that reporting should not require the download or purchase of new technology.

A number of commenters recommended that the same portal be used for Supplemental Reports as for the original reports.

See,

e.g.,

Comments submitted by American Council of Life Insurers, CISA-2022-0010-0095; HIMSS Electronic Health Record Association, CISA-2022-0010-0040; Epic, CISA-2022-0010-0090; Cyber Threat Alliance, CISA-2022-0010-0019; League of Southeastern Credit Unions, CISA-2022-0010-0121; Marty Reynolds, CISA-2022-0010-0135; Patrick Thornton, CISA-2022-0010-0144.

See,

e.g.,

Comments submitted by the Cyber Threat Alliance, CISA-2022-0010-0019; Workgroup for Electronic Data Interchange, CISA-2022-0010-0041; OCHIN, CISA-2022-0010-0039; Cybersecurity Coalition, CISA-2022-0010-0105.

See,

e.g.,

Comments submitted by CHIME, CISA-2022-0010-0035; Business Roundtable, CISA-2022-0010-0115; CTIA, CISA-2022-0010-0070; The Clearing House, CISA-2022-0010-0086.

See,

e.g.,

Comments submitted by the Operational Technology Cybersecurity Coalition, CISA-2022-0010-0108; NTCA—The Rural Broadband Association, CISA-2022-0010-0100; Tenable, CISA-2022-0010-0032.

See,

e.g.,

Comments submitted by the Cybersecurity Coalition, CISA-2022-0010-0105; Information Technology Industry Council, CISA-2022-0010-0097; Credit Union National Association, CISA-2022-0010-0050.

Overall, commenters emphasized the need for a user-friendly reporting form. While several commenters recommended that the reporting form be

standardized for all covered entities,

at least one commenter noted that a uniform reporting format could unintentionally limit the type of information CISA receives.

Many commenters recommended that any reporting form include drop-down menus, check-boxes, or other fields that could be pre-populated for ease of submission.

Other commenters recommended that the incident reporting form generate questions pertinent to the type of incident being reported, including an indication of which fields were required for each type of report.

Several commenters also recommended that CISA assign reference numbers to each report, which would allow entities to more easily locate and return to a specific CIRCIA Incident Reporting Form at a later point.

Commenters also recommended existing reporting or submission procedures that CISA could emulate. Some commenters recommended CISA rely on a standardized approach, noting examples such as the National Information Exchange Model

or Structured Threat Information eXpression (STIX) and Trusted Automated Exchange of Intelligence Information (TAXII).

Other commenters recommended CISA align its reporting approach to that of other Federal departments and agencies such as USCG,

TSA,

or DOD.

See,

e.g.,

Comments submitted by the Alliance for Automotive Innovation, CISA-2022-0010-0082; Lucid Motors, CISA-2022-0010-0078; USTelecom—The Broadband Association, CISA-2022-0010-0067; Palo Alto Networks, CISA-2022-0010-0089.

See,

e.g.,

Comment submitted by the Association of American Railroads, CISA-2022-0010-0117.

See,

e.g.,

Comments submitted by the Workgroup for Electronic Data Interchange, CISA-2022-0010-0041; CTIA, CISA-2022-0010-0070; Anonymous, CISA-2022-0010-0012; National Grain and Feed Association, CISA-2022-0010-0104; Mitchell Berger, CISA-2022-0010-0004; League of Southeastern Credit Unions, CISA-2022-0010-0121; NERC, CISA-2022-0010-0049.

See,

e.g.,

Comments submitted by the Municipal Information Systems Association of California, CISA-2022-0010-0118; City of Roseville, CISA-2022-0010-0111; City of Cerritos, CISA-2022-0010-0084; Cyber Threat Alliance, CISA-2022-0010-0019; (ISC)2, CISA-2022-0010-0112.

See,

e.g.,

Comments submitted by the Arizona Cyber Threat Response Alliance and Arizona Technical Council, CISA-2022-0010-0022; Workgroup for Electronic Data Interchange, CISA-2022-0010-0041.

See,

e.g.,

Comments submitted by the Cyber Threat Alliance, CISA-2022-0010-0019; SolarWinds, CISA-2022-0010-0027; MITRE, CISA-2022-0010-0073.

See,

e.g.,

Comments submitted by ACT | The App Association, CISA-2022-0010-0129; Connected Health Initiative, CISA-2022-0010-0130; Cyber Threat Alliance, CISA-2022-0010-0019; HIMSS, CISA-2022-0010-0119.

See,

e.g.,

Comment submitted by the American Association of Port Authorities, CISA-2022-0010-0126.

See,

e.g.,

Comment submitted by Energy Transfer LP, CISA-2022-0010-0037.

See,

e.g.,

Comment submitted by Trustwave Government Solutions, CISA-2022-0010-0096.

When proposing suggestions for the content of CIRCIA reports, many commenters recommended that CISA require minimal detail at the 72-hour reporting deadline to not divert resources from response efforts,

emphasizing that covered entities should be required to report only what is absolutely needed.

Several commenters recommended a core set of questions be asked for every covered entity,

while others suggested the question set could be sector-specific.

Many commenters offered their thoughts on specific pieces of data that CISA should consider collecting via the CIRCIA reporting form, many, if not most, of which covered entities are statutorily required to include in either Covered Cyber Incident Reports or Ransom Payment Reports.

Some non-statutorily required fields that commenters suggested included: identification of critical infrastructure sector, anyone else that the entity informed, severity of the event, and victim IP addresses.

See,

e.g.,

Comments submitted by BSA | The Software Alliance, CISA-2022-0010-0106; SAP, CISA-2022-0010-0114; Arizona Cyber Threat Response Alliance and Arizona Technical Council, CISA-2022-0010-0022; American Chemistry Council, CISA-2022-0010-0098; U.S. Chamber of Commerce, CISA-2022-0010-0075.

See,

e.g.,

Comments submitted by CHIME, CISA-2022-0010-0035; Google Cloud, CISA-2022-0010-0109; The Clearing House, CISA-2022-0010-0086; Information Technology-ISAC, CISA-2022-0010-0048.

See,

e.g.,

Comments submitted by the Institute of International Finance, CISA-2022-0010-0060; National Association of Chemical Distributors, CISA-2022-0010-0056; UnityPoint Health, CISA-2022-0010-0107; Powder River Energy Corporation, CISA-2022-0010-0099.

See,

e.g.,

Comments submitted by HIMSS, CISA-2022-0010-0109; CHIME, CISA-2022-0010-0035; CTIA, CISA-2022-0010-0070.

See,

e.g.,

Comments submitted by the U.S. Chamber of Commerce, CISA-2022-0010-0075 (recommending that CISA focus on the ten elements listed in CISA's

Sharing Cyber Event Information: Observe, Act, Report

document, namely: incident date and time, incident location, type of observed activity; detailed narrative of the event; number of people or systems affected; company/organization name; point of contact details; severity of event; critical infrastructure sector; and anyone else the entity informed.); Cyber Threat Alliance, CISA-2022-0010-0019 (recommending that the form include three “layers,” containing fields applicable to all incidents (victim information, incident type, incident information, and threat actor information), incident specific fields (with different fields each for business email compromise, ransomware or other extortion, data theft, financial theft such as banking trojans, service theft, denial of service, disruptive or destructive attack, data manipulation or integrity loss, branding/reputation attack, or unauthorized access), and an optional layer for the provision of technical information (such as victim IP addresses, threat actor groups, MITRE ATT&CK mapping, exploited vulnerabilities)); Municipal Information Systems Association of California, CISA-2022-0010-0118 (recommending that the form include impacted “[a]gency,” date of incident, date incident discovered, indicators of compromise, type of data compromised (if applicable), other compliance agencies mandated to receive this report, a description of the incident, steps taken so far, and logs); City of Roseville, CISA-2022-0010-0111 (same); City of Cerritos, CISA-2022-0010-0084 (same); Palo Alto Networks, CISA-2022-0010-0089 (recommending that the template reporting form include the attack vector or vectors that led to the compromise; tactics or techniques used by threat actor; indicators of compromise; information on the affected systems, devices, or networks; information relevant to the identification of the threat actor or actors involved; a point of contact from the affected entity; and impact, earliest known time, and duration of compromise); Mitchell Berger, CISA-2022-0010-0004 (suggesting that CISA include a list of the 16 critical infrastructure sectors, 55 national critical functions, or similar items with boxes to check).

See

id.

vii. Comments on the Deadlines for Submission of CIRCIA Reports

Although the 72-hour reporting deadline for the reporting of a covered cyber incident is codified in the text of CIRCIA itself, several commenters offered thoughts on how to interpret this requirement. Many commenters suggested that CISA provide flexibility in initiating the 72-hour clock due to the challenges entities face in identifying a “reasonable belief” and responding to covered cyber incidents.

Similarly, commenters urged that CISA adopt certain flexibilities in considering the deadline to have been met, such as allowing entities to omit fields on a form when information is not yet known

or provide extensions to the 72-hour deadline when covered entities are experiencing an external event, such as a natural disaster or pandemic.

A few commenters noted that it may not be objective or clear in the moment when a covered entity has a “reasonable belief,” and recommended that CISA consider determining whether a reasonable belief exists on a case-by-case basis.

Many commenters stated that “reasonable belief” should be defined as a confirmed or validated

cyber incident from the perspective of the covered entity and that the 72-hour clock should therefore begin at that time.

See,

e.g.,

Comments submitted by Cybersecurity Coalition, CISA-2022-0010-0105; TechNet, CISA-2022-0010-0072; Federation of American Hospitals, CISA-2022-0010-0063; National Association of Manufacturers, CISA-2022-0010-0087; American Council of Life Insurers, CISA-2022-0010-0095.

See,

e.g.,

Comment submitted by Google Cloud, CISA-2022-0010-0109.

See,

e.g.,

Comment submitted by HIMSS, CISA-2022-0010-0119.

See,

e.g.,

Comments submitted by NCTA—The Internet & Television Association, CISA-2022-0010-0102; SAP, CISA-2022-0010-0114; CTIA, CISA-2022-0010-0070.

See,

e.g.,

Comments submitted by National Electrical Manufacturers Association, CISA-2022-0010-0026; League of Southeastern Credit Unions, CISA-2022-0010-0121; The Associations: AFPM, AGA, API, APGA, INGAA, LEPA, CISA-2022-0010-0057; Trustwave Government Solutions, CISA-2022-0010-0096; Microsoft Corporation, CISA-2022-0010-0058.

Similarly, several commenters recommended specific interpretations for the point at which the 24-hour clock deadline for submission of a Ransom Payment Report should begin. For instance, commenters recommended that the 24-hour clock should begin after the ransom payment is sent,

when “funds or items of value are transmitted to the extorting party,”

or as soon as “any part” of the ransom payment is no longer in possession of the impacted entity or any of its affiliated third parties.

See,

e.g.,

Comments submitted by Exelon Corp., CISA-2022-0010-0043; Cybersecurity Coalition, CISA-2022-0010-0105; Credit Union National Association, CISA-2022-0010-0050; National Association of Chemical Distributors, CISA-2022-0010-0056.

See,

e.g.,

Comment submitted by the Cybersecurity Coalition, CISA-2022-0010-0105.

See,

e.g.,

Comment submitted by Sophos, Inc, CISA-2022-0010-0047.

In regards to Supplemental Reports, while some commenters recommended flexibility, including no deadline for timing of submission of Supplemental Reports,

others recommended CISA provide a separate deadline for the submission of Supplemental Reports.

Recommended deadlines varied from as short as 12 hours after discovering substantially new or different information

to as long as one year after the incident.

On the question of what should constitute substantially new or different information that would necessitate filing a Supplemental Report, many commenters recommended that covered entities be permitted to decide when new findings necessitate a Supplemental Report.

100

Other commenters suggested the types of material changes that could be considered substantial new or different information, such as changes to the types of data stolen or altered; changes to the number or type of systems impacted; or updates to information regarding the TTPs used in the incident.

101

See,

e.g.,

Comments submitted by the Airlines for America, CISA-2022-0010-0066; SAP, CISA-2022-0010-0114.

See,

e.g.,

Comments submitted by SolarWinds, CISA-2022-0010-0027; Workgroup for Electronic Data Interchange, CISA-2022-0010-0041; Telecommunications Industry Association, CISA-2022-0010-0132.

See,

e.g.,

Comment submitted by Sophos, Inc, CISA-2022-0010-0047.

See,

e.g.,

Comment submitted by the Workgroup for Electronic Data Interchange, CISA-2022-0010-0041.

100

See,

e.g.,

Comments submitted by USTelecom—The Broadband Association, CISA-2022-0010-0067; Institute of International Finance, CISA-2022-0010-0060; Exelon Corp., CISA-2022-0010-0043.

101

See,

e.g.,

Comments submitted by the Institute of International Finance, CISA-2022-0010-0060; League of Southeastern Credit Unions, CISA-2022-0010-0121; Payments Leadership Council, CISA-2022-0010-0031.

viii. Comments on Third-Party Submitters

Of the commenters who offered feedback on the third-party submissions of CIRCIA Reports, most seemed to support the framework already contemplated by statute. For instance, one commenter stated that organizations should be able to identify a third party to submit on their behalf,

102

and more than one stated that the reporting mechanisms, guidelines, and procedures should be the same for the third-party submitter as for the covered entity.

103

Many commenters recommend that CISA clarify that the duty to comply with the regulation falls on the covered entity,

104

and that third-party submitters have no obligation to report on the covered entity's behalf.

105

102

See,

e.g.,

Comment submitted by American Chemistry Council, CISA-2022-0010-0098.

103

See,

e.g.,

Comments submitted by American Chemistry Council, CISA-2022-0010-0098; CrowdStrike, CISA-2022-0010-0128.

104

See,

e.g.,

Comments submitted by BlackBerry; CISA-2022-0010-0036; American Property Casualty Insurance Association, CISA-2022-0010-0064; Computing Technology Industry Association, CISA-2022-0010-0122.

105

See,

e.g.,

Comments submitted by the Cyber Threat Alliance, CISA-2022-0010-0019; Airlines for America, CISA-2022-0010-0066; Operational Technology Cybersecurity Coalition, CISA-2022-0010-0108; Information Technology-ISAC, CISA-2022-0010-0048; BlackBerry, CISA-2022-0010-0036.

Some commenters recommended additional safeguards for covered entities using third-party reporters. A few commenters recommended that CISA clarify the types of third parties authorized to submit reports on behalf of the covered entity.

106

One commenter recommended that CISA consider entities like ISACs to be suitable third-party reporters.

107

Multiple commenters also recommended that CISA allow third-party submitters to register with CISA as a known third-party submitter.

108

106

See,

e.g.,

Comments submitted by Exelon Corp., CISA-2022-0010-0043; The Associations: AFPM, AGA, API, APGA, INGAA, LEPA, CISA-2022-0010-0057.

107

See,

e.g.,

Comment submitted by the Association of Metropolitan Water Agencies, CISA-2022-0010-0088.

108

See,

e.g.,

Comments submitted by BSA | The Software Alliance, CISA-2022-0010-0106; SAP, CISA-2022-0010-0114; Information Technology Industry Council, CISA-2022-0010-0097.

ix. Comments on Data and Records Preservation Requirements

Very few commenters offered recommendations related to data and records preservation requirements. Several of those that did recommended CISA not impose additional data and records preservation requirements on covered entities via the CIRCIA regulation, and instead defer to covered entities' existing legal obligations or specific requests from law enforcement.

109

Only one commenter offered suggestions on the type of information that covered entities should preserve,

110

while a small number of commenters recommended lengths of time for how long CISA should require information to be preserved.

111

109

See,

e.g.,

Comments submitted by Mandiant, CISA-2022-0010-0120; Accenture, CISA-2022-0010-0077; USTelecom—The Broadband Association, CISA-2022-0010-0067.

110

See,

e.g.,

Comment submitted by Sophos, Inc, CISA-2022-0010-0047 (recommending that information preserved should include at least all logs containing data related to the incident, such as network logs, system logs, and access logs; all correspondence with attackers, including any notes taken during any unrecorded interactions; all identified TTPs and indicators of compromise; all data related to any ransomware payment; and contact information of individuals and entities that provided tactical support in the incident response and investigation process).

111

See,

e.g.,

Comments submitted by Sophos, Inc., CISA-2022-0010-0047; SAP, CISA-2022-0010-0114; National Association of Chemical Distributors, CISA-2022-0010-0056.

x. Comments on Other Existing Cyber Incident Reporting Requirements and the Substantially Similar Reporting Exception

Many commenters offered feedback on the breadth of existing Federal, SLTT, and international cyber incident reporting requirements, and the potential for overlap, conflict, or alignment between CIRCIA and those requirements. CISA will not summarize the specific reporting requirements that commenters mentioned, because CISA provides a high-level summary of these existing reporting requirements in Section III.B in this document.

To avoid duplicative and burdensome reporting, several commenters recommended that CISA align its reporting requirements with existing Federal and SLTT requirements.

112

Commenters frequently recommended that CISA consult with other Federal departments and agencies with pre-existing regulatory authority in the commenters' particular sectors to avoid duplicative requirements in the CIRCIA regulation. Numerous commenters recommended that, alongside harmonization efforts, CISA should establish a single, national point of contact or process for mandatory cyber incident reporting,

113

suggesting that DHS or CISA serve as the primary or sole entity for receiving and disseminating cyber incident report information.

114

Many commenters, noting the language in CIRCIA to this effect, encouraged CISA to implement the reporting exemption for covered entities that submit cyber incident reports with substantially similar information to other Federal departments and agencies, within a substantially similar timeframe.

115

A few commenters offered criteria for determining whether a report submitted to another Federal entity constitutes “substantially similar reported information.”

116

Commenters also offered suggestions on which existing reporting obligations should be considered to include substantially similar information. These suggestions included the Cyber Incident Notification Requirements for Federally Insured Credit Unions (FICUs), located at 12 CFR 748.1;

117

the DFARS incident reporting requirement, located at 48 CFR 252.204-7012;

118

Cyber Security Event Notifications for Commercial Nuclear Power Reactors, located at 10 CFR 73.77; TSA Security Directive Pipeline-2021-01 series, Enhancing Pipeline Cybersecurity;

119

and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Breach Notification Rule, located at 45 CFR 164.400-414, and corresponding Health Information Technology for Economic and Clinical Health (HITECH) Act Health Breach Notification Rule, located at 16 CFR part 318, which applies to entities not subject to the HIPAA Breach Notification Rule.

120

112

See,

e.g.,

Comments submitted by National Association of Secretaries of State, CISA-2022-0010-0054; OCHIN, CISA-2022-0010-0039; HIMSS Electronic Health Record Association, CISA-2022-0010-0040; Alliance for Automotive Innovation,

CISA-2022-0010-0082; Lucid Motors, CISA-2022-0010-0078; Center for Democracy & Technology, CISA-2022-0010-0068.

113

See,

e.g.,

Comments submitted by Indiana Municipal Power Agency, CISA-2022-0010-0018; HIMSS, CISA-2022-0010-0119; Exelon Corp., CISA-2022-0010-0043; MITRE, CISA-2022-0010-0073; Options Security Corporation, CISA-2022-0010-0160; Airport Council International North America, CISA-2022-0010-0135; Cameron Braatz, CISA-2022-0010-0154.

114

See,

e.g.,

Comments submitted by The Associations, CISA-2022-0010-0057: AFPM, AGA, API, APGA, INGAA, LEPA; Google Cloud, CISA-2022-0010-; Express Association of America, CISA-2022-0010-0038; Workgroup for Electronic Data Interchange, CISA-2022-0010-0041; internet Infrastructure Coalition, CISA-2022-0010-0055; American Council of Life Insurers, CISA-2022-0010-0095; Business Roundtable, CISA-2022-0010-0115.

115

See,

e.g.,

Comments submitted by the American Public Power Association and the Large Public Power Council, CISA-2022-0010-0028; National Rural Electric Cooperative Association, CISA-2022-0010-0025; California Special Districts Association, CISA-2022-0010-0042; Professional Services Council, CISA-2022-0010-0044; American Association of Port Authorities, CISA-2022-0010-0126; Virginia Port Authority, CISA-2022-0010-0052; CHIME, CISA-2022-0010-0035; AHIP, CISA-2022-0010-0091.

116

See,

e.g.,

Comments submitted by Payments Leadership Council, CISA-2022-0010-0031 (recommending CISA consider a report to include substantially similar information if “the material essence of the incident is reflected in the information contained within the report to the other federal entity”); BSA | The Software Alliance, CISA-2022-0010-0106 (recommending that there be a “rebuttable presumption that a report provided by a covered entity to another federal entity is substantially similar”).

117

See,

e.g.,

Comment submitted by NAFCU, CISA-2022-0010-0076.

118

See,

e.g.,

Comments submitted by U.S. Chamber of Commerce, CISA-2022-0010-0075; National Defense ISAC, CISA-2022-0010-0144.

119

See,

e.g.,

Comments submitted by Energy Transfer LP, CISA-2022-0010-0037

120

See Comment submitted by Nuclear Energy Institute, CISA-2022-0010-0029; see also comment submitted by Blue Cross Blue Shield Association, CISA-2022-0010-0103.

xi. Comments on Noncompliance and Enforcement

A small number of commenters offered recommendations related to noncompliance and enforcement of the CIRCIA regulations. These commenters encouraged CISA to keep in mind that covered entities are victims of an incident

121

and recommended that CISA focus on collaboration, not enforcement.

122

Similarly, a number of commenters recommended that CISA not penalize entities for reporting in good faith under the rule.

123

Such possible penalties that commenters recommended CISA avoid included pursuing enforcement under CIRCIA or allowing CIRCIA Reports to be the basis for enforcement actions by other Federal departments and agencies under separate regulations.

124

One commenter suggested that non-profit, self-incorporated fire and Emergency Management Service departments be excluded from enforcement in the same manner as SLTT Government Entities.

125

121

See,

e.g.,

Comments submitted by the National Technology Security Coalition, CISA-2022-0010-0061; The Associations: BPI, ABA, IIB, SIFMA, CISA-2022-0010-0046.

122

See,

e.g.,

Comments submitted by Airlines for America, CISA-2022-0010-0066; Connected Health Initiative, CISA-2022-0010-0130; ACT—The App Association CISA-2022-0010-0129.

123

See,

e.g.,

Comments submitted by the Association of American Railroads, CISA-2022-0010-0117; SolarWinds, CISA-2022-0010-0027; NTCA—The Rural Broadband Association, CISA-2022-0010-0100.

124

Id.

125

See,

e.g.,

Comment submitted by the International Association of Fire Chiefs, CISA-2022-0010-0081.

xii. Comments on Treatment and Restrictions on Use of CIRCIA Reports

Numerous commenters provided recommendations on the treatment and restrictions on use of CIRCIA Reports and information therein. One consistent theme throughout the comments on this topic was the notion that CISA should take steps to ensure the confidentiality of the information, including the identity of the victims of reported cyber incidents, included in CIRCIA Reports.

126

Some of the procedural strategies recommended by commenters to achieve this include having CISA anonymize and aggregate cyber incident report information prior to sharing it with others,

127

exempting CIRCIA Reports and/or the information contained therein from release under FOIA and similar state laws,

128

and considering treating CIRCIA Reports as Protected Critical Infrastructure Information, “confidential,” or “secret.”

129

Numerous commenters also stressed the need for CISA to protect information submitted in CIRCIA Reports through strong data protection standards, data security practices, and data privacy safeguards.

130

126

See,

e.g.,

Comments submitted by IBM, CISA-2022-0010-0069; Gideon Rasmussen, CISA-2022-0010-0011; Institute of International Finance, CISA-2022-0010-0060; Powder River Energy Corporation, CISA-2022-0010-0099.

127

See,

e.g.,

Comments submitted by Fidelity National Information Services, CISA-2022-0010-0033; UnityPoint Health, CISA-2022-0010-0107; Institute of International Finance, CISA-2022-0010-0060.

128

See,

e.g.,

Comments submitted by Edison Electric Institute, CISA-2022-0010-0079; HIMSS, CISA-2022-0010-0119; National Grain and Feed Association, CISA-2022-0010-0104; NAFCU, CISA-2022-0010-0076.

129

See,

e.g.,

Comments submitted by NCTA, CISA-2022-0010-0102; SAP, CISA-2022-0010-0114.

130

See,

e.g.,

Comments submitted by the Financial Services Sector Coordinating Council, CISA-2022-0010-0094; The Clearing House, CISA-2022-0010-0086; Payments Leadership Council, CISA-2022-0010-0031.

Commenters also suggested several different limitations on the use of the information contained in CIRCIA Reports. A number of commenters recommended CISA include adequate liability protections in the proposed regulation.

131

Other commenters recommended CISA clarify that reporting does not result in the waiver

of attorney-client privilege, trade secret protections, or other privileges or protections.

132

A few commenters recommended that information contained in CIRCIA Reports be protected from discovery in civil or criminal actions.

133

One commenter recommended that the various protections afforded to CIRCIA Reports still apply even in the event that a CIRCIA Report is compromised (

i.e.,

accessed by an unauthorized individual or made public in an unauthorized manner).

134

131

See,

e.g.,

Comments submitted by American Chemistry Council, CISA-2022-0010-0098; SolarWinds, CISA-2022-0010-0027; The Associations: BPI, ABA, IIB, SIFMA, CISA-2022-0010-0046.

132

See,

e.g.,

Comments submitted by CrowdStrike, CISA-2022-0010-0128; U.S. Chamber of Commerce, CISA-2022-0010-0075; Connected Health Initiative, CISA-2022-0010-0130.

133

See,

e.g.,

Comments submitted by Connected Health Initiative, CISA-2022-0010-0130; ACT | The App Association, CISA-2022-0010-0129.

134

See Comment submitted by submitted by Health-ISAC and the Healthcare and Public Health Sector Coordinating Council Cybersecurity Working Group, CISA-2022-0010-0123.

IV. Discussion of Proposed Rule

A. Definitions

Section 226.1 of the proposed rule contains proposed definitions for certain terms used within the rule. These proposed definitions are intended to help clarify the meaning of various terms used throughout the proposed rule and promote consistency in application of the regulatory requirements.

For a number of the terms, CISA proposes using, either verbatim or with minor adjustments, definitions provided in the Definitions sections of CIRCIA, as amended (6 U.S.C. 681). For several other terms where CIRCIA does not include a CIRCIA-specific definition, CISA proposes using, either verbatim or with minor adjustments, definitions provided in the Definitions sections at Section 2 of the Homeland Security Act of 2002 (6 U.S.C. 101) or at the beginning of Title XXII of the Homeland Security Act of 2002 (6 U.S.C. 650), each as amended, since definitions in those sections also apply to CIRCIA. Proposed definitions that are derived from these legal authorities include:

cloud service provider; cyber incident; Cybersecurity and Infrastructure Security Agency or CISA; cybersecurity threat; Director; information system; managed service provider; ransom payment; ransomware attack; supply chain compromise; and virtual currency.

Additionally, CISA is proposing definitions for a variety of terms that will have a specific meaning within the proposed regulation. These include

CIRCIA; CIRCIA Agreement; CIRCIA Report;

covered cyber incident; Covered Cyber Incident Report;

covered entity; Joint Covered Cyber Incident and Ransom Payment Report; personal information;

Ransom Payment Report; State, Local, Tribal, or Territorial Government entity or SLTT Government entity;

substantial cyber incident;

and

Supplemental Report.

The basis for each of these proposed definitions is discussed in their respective subsection below.

i. Covered Entity

Covered entity

is a key term in the proposed regulation as, among other things, it is the operative term used to describe the regulated parties responsible for complying with the covered cyber incident and ransom payment reporting and data and records preservation requirements in the proposed CIRCIA regulation. While the statute includes a definition for the term covered entity, the statute explicitly requires CISA to further clarify the meaning of that term through description in the CIRCIA rulemaking. Specifically, the statute defines covered entity to mean “an entity in a critical infrastructure sector, as defined in Presidential Policy Directive 21, that satisfies the definition established by the Director in the final rule issued pursuant to section 681b(b) of this title.” 6 U.S.C. 681(4). CIRCIA also requires CISA to include a “clear description of the types of entities that constitute covered entities” in the final rule based on various specified factors. 6 U.S.C. 681b(c)(1).

CISA proposes to provide the criteria for covered entities in an Applicability section at § 226.2 of the regulation with a cross-reference to the Applicability section in the Definitions section under the term covered entity. See Section IV.B below and § 226.2 for a detailed discussion of the proposed covered entity criteria and the “clear description of the types of entities that constitute covered entities,” required by 6 U.S.C. 681b(c)(1).

ii. Cyber Incident, Covered Cyber Incident, and Substantial Cyber Incident

1. Cyber Incident

CISA is proposing to include in the regulation a definition of the term cyber incident. The definition of cyber incident is important as it will help bound the types of incidents that trigger reporting requirements for covered entities under the proposed regulation.

CIRCIA states that the term cyber incident “(A) has the meaning given the term `incident' in section 2209; and (B) does not include an occurrence that imminently, but not actually, jeopardizes—(i) information on information systems; or (ii) information systems.” See 6 U.S.C. 681(5). Section 2209's definition of “incident” has since been moved to Section 2200 and defines the term “incident” as “an occurrence that actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information on an information system, or actually or imminently jeopardizes, without lawful authority, an information system.” See 6 U.S.C. 650(12).

135

The definition of “incident” was moved from Section 2209 of the Homeland Security Act (6 U.S.C. 659) to Section 2200 of the Homeland Security Act (6 U.S.C. 650(12)) as part of the consolidation of definitions in Section 7143 (CISA Technical Corrections and Improvements) of the James M. Inhofe National Defense Authorization Act for Fiscal Year 2023 (hereinafter, “CISA Technical Corrections”). Public Law 117-263, Div. G, Title LXXI, § 7143, Dec. 23, 2022. Section (f)(2) of the CISA Technical Corrections includes a rule of construction that provides that “[a]ny reference to a term defined in the Homeland Security Act of 2002 (6 U.S.C. 101

et seq.

) on the day before the date of enactment of this Act that is defined in section 2200 of that Act pursuant to the amendments made under this Act shall be deemed to be a reference to that term as defined in section 2200 of the Homeland Security Act of 2002, as added by this Act.” Pursuant to this rule of construction, the cross-reference in CIRCIA's definition of “cyber incident” to the definition of “incident” in Section 2209 of the Homeland Security Act (6 U.S.C. 659) is deemed a reference to the definition of “incident” in Section 2200 of the Homeland Security Act (6 U.S.C. 650).

CISA is proposing to define cyber incident to mean an occurrence that actually jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information on an information system, or actually jeopardizes, without lawful authority, an information system. The definition would use the 6 U.S.C. 650 definition verbatim other than striking the “imminently jeopardizes” clause in that definition, as required by 6 U.S.C. 681(5)(B).

2. Covered Cyber Incident

CIRCIA requires CISA to include within the proposed rule a definition for the term covered cyber incident. See 6 U.S.C. 681(3). Because CIRCIA requires covered entities to report only those cyber incidents that qualify as covered cyber incidents to CISA, this definition is essential for triggering the reporting requirement. CISA is proposing to define the term covered cyber incident to mean a substantial cyber incident experienced by a covered entity. CISA also proposes definitions for both substantial cyber incident and covered entity within this NPRM.

Within CIRCIA, Congress defined a covered cyber incident as “a substantial cyber incident experienced by a covered entity that satisfies the definition and

criteria established by the Director in the final rule issued pursuant to section 681b(b) of this title.” See 6 U.S.C. 681(3). CISA believes that defining a covered cyber incident to include all substantial cyber incidents experienced by a covered entity rather than some subset thereof is both consistent with the statutory definition of covered cyber incident and is the least complicated approach to defining covered cyber incidents.

Under this approach, a covered entity simply needs to determine if a cyber incident is a substantial cyber incident for it to be reported, rather than having to perform an additional analysis to determine if a substantial cyber incident meets some narrower criteria for a covered cyber incident. As the term substantial cyber incident is not used in CIRCIA other than to help define a covered cyber incident, CISA does not see any benefit to having one set of requirements for what constitutes a substantial cyber incident and a separate set of requirements for which substantial cyber incidents experienced by a covered entity qualify as covered cyber incidents.

3. Substantial Cyber Incident

CISA is proposing to include within the rule a definition for the term substantial cyber incident. Given CISA's proposal to define a covered cyber incident as a substantial cyber incident experienced by a covered entity, the term substantial cyber incident is essential to the CIRCIA regulation as it identifies the types of incidents that, when experienced by a covered entity, must be reported to CISA.

While CIRCIA does not define the term substantial cyber incident, it provides minimum requirements for the types of substantial cyber incidents that qualify as covered cyber incidents. See 6 U.S.C. 681b(c)(2)(A). Consistent with these minimum requirements, CISA proposes the term substantial cyber incident to mean a cyber incident that leads to any of the following: (a) a substantial loss of confidentiality, integrity, or availability of a covered entity's information system or network; (b) a serious impact on the safety and resiliency of a covered entity's operational systems and processes; (c) a disruption of a covered entity's ability to engage in business or industrial operations, or deliver goods or services; or (d) unauthorized access to a covered entity's information system or network, or any nonpublic information contained therein, that is facilitated through or caused by either a compromise of a cloud service provider, managed service provider, other third-party data hosting provider, or a supply chain compromise. CISA is further proposing that a substantial cyber incident resulting in one of the listed impacts include any cyber incident regardless of cause, including, but not limited to, a compromise of a cloud service provider, managed service provider, or other third-party data hosting provider; a supply chain compromise; a denial-of-service attack; a ransomware attack; or exploitation of a zero-day vulnerability. Finally, CISA is proposing the term substantial cyber incident does not include (a) any lawfully authorized activity of a United States Government entity or SLTT Government entity, including activities undertaken pursuant to a warrant or other judicial process; (b) any event where the cyber incident is perpetrated in good faith by an entity in response to a specific request by the owner or operator of the information system; or (c) the threat of disruption as extortion, as described in 6 U.S.C. 650(22).

136

The definition of ransomware attack contained in Section 2240(14)(A) was originally codified in 6 U.S.C. 681(14) but was moved from 6 U.S.C. 681(14) to 6 U.S.C. 650(22) as part of the consolidation of definitions in the CISA Technical Corrections,

supra

note 135. The CISA Technical Corrections, however, did not update this cross-reference in CIRCIA. Nevertheless, pursuant to the rule of construction in Section (f)(2) of the CISA Technical Corrections, the cross reference in 6 U.S.C. 681b(c)(2)(C)(ii) to part of the definition of ransomware attack in 6 U.S.C. 681(14) is deemed a reference to the definition of ransomware attack now in 6 U.S.C. 650 (Section 2200 of the Homeland Security Act).

In developing this proposed definition, CISA examined how other Federal departments and agencies that regulate cyber incident reporting define similar terminology for their reporting regimes, reviewed the Model Definition for a Reportable Cyber Incident proposed by the Secretary of Homeland Security in the CIRC-informed DHS Report to Congress (the “CIRC Model Definition”), and considered the many comments received on this topic from stakeholders both at CIRCIA listening sessions and in written comments submitted in response to the CIRCIA RFI. CISA considered those various perspectives and approaches both within the constraints explicitly imposed by CIRCIA and in light of the purposes for which CISA believes CIRCIA was created as described in Section III.C in this document.

The proposed definition contains the following elements: (1) a set of four threshold impacts which, if one or more occur as the result of a cyber incident, would qualify that cyber incident as a substantial cyber incident; (2) an explicit acknowledgment that substantial cyber incidents can be caused through compromises of third-party service providers or supply chains, as well as various techniques and methods; and (3) three separate types of incidents that, even if they were to meet the other criteria contained within the substantial cyber incident definition, would be excluded from treatment as a substantial cyber incident. Each of these elements is addressed in turn below.

a. Minimum Requirements for a Cyber Incident To Be a Substantial Cyber Incident

While Congress did not define the term substantial cyber incident in CIRCIA, Congress did include minimum requirements for the types of substantial cyber incidents that constitute covered cyber incidents. See 6 U.S.C. 681b(c)(2)(A).

137

Because CISA is proposing that a covered cyber incident mean any substantial cyber incident experienced by a covered entity (see Section IV.A.ii.2 in this document), CISA interprets the minimum requirements enumerated in 6 U.S.C. 681b(c)(2)(A) as the minimum requirements an incident must meet to be considered a substantial cyber incident (as opposed to a subset of substantial cyber incidents that constitute covered cyber incidents). Thus, while CISA has discretion to raise the threshold required for something to be a substantial cyber incident, resulting in a reduction of the number of incidents that would qualify as substantial, CISA may not lower the threshold below the requirements enumerated in 6 U.S.C. 681b(c)(2)(A).

137

6 U.S.C. 681b(c)(2)(A) states that the types of substantial cyber incidents that constitute covered cyber incidents must, “at a minimum, require the occurrence of (i) a cyber incident that leads to substantial loss of confidentiality, integrity, or availability of such information system or network, or a serious impact on the safety and resiliency of operational systems and processes; (ii) a disruption of business or industrial operations, including due to a denial-of-service attack, ransomware attack, or exploitation of a zero day vulnerability, against (I) an information system or network; or (II) an operational technology system or process; or (iii) unauthorized access or disruption of business or industrial operations due to loss of service facilitated through, or caused by, a compromise of a cloud service provider, managed service provider, or other third-party data hosting provider or by a supply chain compromise.”

CISA believes that the minimum requirements enumerated in 6 U.S.C. 681b(c)(2)(A) create a sufficiently high threshold to prevent overreporting by making it clear that routine or minor cyber incidents do not need to be reported. Accordingly, CISA is proposing to use those requirements as the basis for the first part of the definition of substantial cyber incident,

with minor modifications for clarity and for greater consistency with the CIRC Model Definition of a reportable cyber incident. Ultimately, CISA is proposing four types of impacts that, if experienced by a covered entity as a result of a cyber incident, would result in the incident being classified as a substantial cyber incident and therefore reportable under the CIRCIA regulation. Each of these impact types is described in its own prong of the substantial cyber incident definition.

i. Impact 1: Substantial Loss of Confidentiality, Integrity, or Availability

Under the first proposed threshold impact, a cyber incident would be considered a substantial cyber incident if it resulted in a substantial loss of confidentiality, integrity, or availability of a covered entity's information system or network. See § 226.1 of the proposed regulation. This impact reflects the substantive criteria contained in the first part of 6 U.S.C. 681b(c)(2)(A)(i), which states “a cyber incident that leads to substantial loss of confidentiality, integrity, or availability of such information system or network.” Although this prong does not explicitly mention operational technology (OT)), CISA is using the term “information system,” (which, per the proposed definition, as described in Section IV.A.iv.7 in this document, includes OT) in this threshold and proposes to interpret this aspect of the regulation to also specifically cover cyber incidents that lead to substantial loss of confidentiality, integrity, or availability of a covered entity's OT.

The concepts of confidentiality, integrity, and availability (CIA), often referred to as the “CIA triad,” represent the three pillars of information security.

138

“Confidentiality” refers to “preserving authorized restrictions on information access and disclosure, including means for protecting personal privacy and proprietary information.”

139

“Integrity” refers to “guarding against improper information modification or destruction and ensuring information non-repudiation and authenticity.”

140

“Availability” refers to “ensuring timely and reliable access to and use of information.”

141

138

See,

e.g.,

NIST,

Data Integrity: Identifying and Protecting Assets Against Ransomware and Other Destructive Events,

NIST Special Publication 1800-25 Vol. A at 1 (Dec. 2020), available at

https://csrc.nist.gov/pubs/sp/1800/25/final.

139

Id.

140

Id.

141

Id.

The loss of CIA of an information system, including OT, or network can occur in many ways. For example, if an unauthorized individual steals credentials or uses a brute force attack to gain access to a system, they have caused a loss of the confidentiality of a system. If that unauthorized individual uses that access to modify or destroy any information on the system, they have caused a loss of the integrity of the system and potentially a loss of the availability of the information contained therein. A denial-of-service attack that renders a system or network inaccessible is another example of an incident that leads to a loss of the availability of the system or network. These are just some of the many types of incidents that can lead to a loss of CIA and would be reportable if the impacts are “substantial.”

Whether a loss of CIA constitutes a “substantial” loss will likely depend on a variety of factors, such as the type, volume, impact, and duration of the loss. One example of a cyber incident that typically would meet the “substantial” threshold for this impact type is a distributed denial-of-service attack that renders a covered entity's service unavailable to customers for an extended period of time. Similarly, a ransomware attack or other attack that encrypts one of a covered entity's core business or information systems substantially impacting the confidentiality, availability, or integrity of the entity's data or services likely also would meet the threshold of a substantial cyber incident under this first impact type and would need to be reported under the CIRCIA regulation. Persistent access to information systems by an unauthorized third party would typically be considered a substantial loss of confidentiality. By contrast, even time-limited access to certain high-value information systems, such as access to privileged credentials or to a domain controller, could also be considered a substantial loss of confidentiality. A large-scale data breach or otherwise meaningful exfiltration of data typically would also be considered a substantial cyber incident as it would reflect a substantial loss of the confidentiality of an information system. A theft of data that may or may not itself meet the “substantial” impact threshold by nature of the data theft alone (based on the type or volume of data stolen) could become a substantial cyber incident if the theft is followed by a data leak or a credible threat to leak data. Conversely, CISA would not expect a denial-of-service attack or other incident that results in a covered entity's public-facing website being unavailable for a few minutes to typically rise to the level of a substantial cyber incident under this impact.

142

The examples provided in this paragraph and elsewhere in this section of what typically might or might not be considered a substantial cyber incident are simply a few sample scenarios meant to provide context around this discussion. The examples are not meant as an exhaustive or definitive list of what is and is not a substantial cyber incident. Whether something is or is not a substantial cyber incident is fact-dependent and must be assessed on a case-by-case basis. For example, while, as noted, an incident resulting in a brief unavailability of a public-facing website would typically not qualify as a substantial loss of availability, such an incident may be significant for a covered entity whose public-facing website is a core part of its service offering (such as a webmail provider).

ii. Impact 2: Serious Impact on Safety and Resiliency of Operational Systems and Processes

The second impact type of the proposed substantial cyber incident definition would require a covered entity to report a cyber incident that results in a serious impact on the safety and resiliency of a covered entity's operational systems and processes. This impact reflects the threshold enumerated in the second part of 6 U.S.C. 681b(c)(2)(A)(i), which states “a cyber incident that leads to . . . a serious impact on the safety and resiliency of operational systems and processes.” Safety is a commonly understood term, which NIST defines as “[f]reedom from conditions that can cause death, injury, occupational illness, damage to or loss of equipment or property, or damage to the environment.”

143

NIST defines resilience as “[t]he ability to prepare for and adapt to changing conditions and withstand and recover rapidly from disruption,” and operational resilience as “[t]he ability of systems to resist, absorb, and recover from, or adapt to an adverse occurrence during operation that may cause harm, destruction, or loss of the ability to perform mission-related functions.”

144

143

NIST,

Developing Cyber-Resilient Systems,

NIST Special Publication 800-160 Vol. 2 Rev. 1, at 67 (Dec. 2021), available at

https://csrc.nist.gov/pubs/sp/800/160/v2/r1/final.

144

Id.

at 65-66.

Similar to the interpretation of the word “substantial” in the first impact type, whether an impact on the safety and resiliency of an operational system or process is “serious” will likely depend on a variety of factors, such as the safety or security hazards associated with the system or process, and the scale and duration of the impact. For example, a cyber incident that noticeably increases the potential for a release of a hazardous material used in chemical manufacturing or water purification likely would meet this

definition. Similarly, a cyber incident that compromised or disrupted a BES cyber system that performs one or more reliability tasks would also likely meet this prong of the substantial cyber incident definition. Further, a cyber incident that disrupts the ability of a communications service provider to transmit or deliver emergency alerts or 911 calls, or results in the transmission of false emergency alerts or 911 calls, would meet this definition. While CISA anticipates that the types of incidents that will actually lead to a serious impact to the safety and resilience of operational systems and processes may frequently involve OT, CISA does not interpret “operational systems and processes” to be a reference to OT. Congress used the specific phrase “operational technology” elsewhere in CIRCIA—including in the immediate next provision—and therefore certainly could have used it in this provision if that was the intent. Compare 6 U.S.C. 681b(c)(2)(A)(i) with 6 U.S.C. 681b(c)(2)(A)(ii)(II)). Accordingly, CISA interprets this prong broadly as not being limited to only incidents impacting OT, and covered entities should report incidents that are covered cyber incidents under this prong of the definition even if the impacts that meet the threshold are not to OT.

iii. Impact 3: Disruption of Ability To Engage in Business or Industrial Operations

The third impact of the proposed substantial cyber incident definition would require a covered entity to report an incident that results in a disruption of a covered entity's ability to engage in business or industrial operations, or deliver goods or services. This prong reflects criteria enumerated by Congress in both 6 U.S.C. 681b(c)(2)(A)(ii) and (iii), which provides that one type of incident that could qualify as a substantial cyber incident that constitutes a covered cyber incident is a cyber incident that causes a disruption of business or industrial operations, including due to a denial-of-service attack, ransomware attack, or exploitation of a zero-day vulnerability, against (I) an information system or network; or (II) an operational technology system or process; or unauthorized access or disruption of business or industrial operations due to loss of service facilitated through, or caused by, a compromise of a CSP, managed service provider, or other third-party data hosting provider or by a supply chain compromise.

In drafting this prong, CISA has added two clauses to the statutory criteria relating to an entity's ability to engage in business operations or deliver goods or services. CISA proposes adding these clauses to this prong of the substantial cyber incident definition to clarify CISA's understanding of the statutory language. CISA understands that a disruption of business operations includes a disruption to an entity's ability to engage in business operations and the ability to deliver goods or services. CISA considers this language to be a clarification of the statutory language, and not an expansion.

NIST defines a disruption as “[a]n unplanned event that causes a . . . system to be inoperable for a length of time (

e.g.,

minor or extended power outage, extended unavailable network, or equipment or facility damage or destruction).”

145

As opposed to the statutory source for the first two prongs of this definition, the portion of CIRCIA from which this prong is drawn does not contain a qualifier such as “substantial” or “serious.” Nevertheless, because this prong is part of the threshold for a “substantial” cyber incident, CISA believes it is appropriate to read into the prong some level of significance. Like the previous prongs, whether a disruption rises to the level of reportability may depend on a variety of factors and circumstances, such as the scope of the disruption and what was disrupted. A relatively minor disruption to a critical system or network could rise to a high level of substantiality, while a significant disruption to a non-critical system or network might not. Generally speaking, incidents that result in minimal or insignificant disruptions are unlikely to rise to the level of a substantial cyber incident reportable under this prong; however, the specific circumstances of the disruption should be taken into consideration.

145

NIST,

Contingency Planning Guide for Federal Information Systems,

NIST Special Publication 800-34 Rev. 1, Appendix G, (May 2010), available at

https://csrc.nist.gov/pubs/sp/800/34/r1/upd1/final.

While 6 U.S.C. 681b(c)(2)(A)(ii) provides that this category includes disruptions of business or industrial operations “due to a denial of service attack, ransomware attack, or exploitation of a zero day vulnerability,” CISA is not proposing to include this language in this third prong, as CISA reads this language as being illustrative of the types of incidents that might lead to a disruption of business or industrial operations, rather than a limitation on the types of incidents that can be reportable under this prong. To that end, examples of cyber incidents that would meet this prong include the exploitation of a zero-day vulnerability resulting in the extended downtime of a covered entity's information system or network, a ransomware attack that locks a covered entity out of its industrial control system, or a distributed denial-of-service attack that prevents customers from accessing their accounts with a covered entity for an extended period of time. Another example would be where a critical access hospital is unable to operate due to a ransomware attack on a third-party medical records software company on whom the critical access hospital relies; the critical access hospital, and perhaps the medical records software company as well if it also is a covered entity, would need to report the incident. Cyber incidents that result in minor disruptions, such as short-term unavailability of a business system or a temporary need to reroute network traffic, typically would not be considered substantial under this prong.

iv. Impact 4: Unauthorized Access Facilitated Through or Caused by a: (1) Compromise of a CSP, Managed Service Provider, or Other Third-Party Data Hosting Provider, or (2) Supply Chain Compromise

The fourth prong of the proposed substantial cyber incident definition would require a covered entity to report an incident that results in unauthorized access to a covered entity's information system or network, or any nonpublic information contained therein, that is facilitated through or caused by a compromise of a CSP, managed service provider, other third-party data hosting provider, or by a supply chain compromise. This prong reflects criteria enumerated in 6 U.S.C. 681b(c)(2)(A)(iii).

NIST defines unauthorized access as occurring when an individual “gains logical or physical access without permission to a network, system, application, data, or other resource.”

146

Unauthorized access causes actual jeopardy to information systems and the information therein by compromising the first pillar of the CIA triad—confidentiality—and by providing an adversary with a launching off point for additional penetration of a system or network. Much like the third prong, the source language in CIRCIA does not contain any qualifier such as “substantial” or “serious.” However, unlike that prong, CISA understands the absence of a qualifier here to be a reflection of the seriousness of

unauthorized access through a third party (such as a managed service provider or CSP) or a supply chain compromise. Such cyber incidents uniquely have the ability to cause significant or substantial na

This text is long and has been trimmed here. Open the source document for the complete record.

This is a copy of a public record, reproduced as it was published. It is not legal advice, and it may not be the version a court would rely on. Check the official source before you cite it.