# Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements > Briefs, arguments, decisions, and more. URL: https://www.frixlaw.com/law-library/documents/fr%3A2024-06526 ## Record - **Collection:** Federal Register - **Document type:** Proposed Rule - **Published:** April 4, 2024 - **Citation:** 89 FR 23644 ## Text DEPARTMENT OF HOMELAND SECURITY Cybersecurity and Infrastructure Security Agency 6 CFR Part 226 [Docket No. CISA-2022-0010] RIN 1670-AA04 Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements AGENCY: Cybersecurity and Infrastructure Security Agency, DHS ACTION: Proposed rule. SUMMARY: The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), as amended, requires the Cybersecurity and Infrastructure Security Agency (CISA) to promulgate regulations implementing the statute's covered cyber incident and ransom payment reporting requirements for covered entities. CISA seeks comment on the proposed rule to implement CIRCIA's requirements and on several practical and policy issues related to the implementation of these new reporting requirements. DATES: Comments and related material must be submitted on or before June 3, 2024. ADDRESSES: You may send comments, identified by docket number CISA-2022-0010, through the Federal eRulemaking Portal available at http://www.regulations.gov. Instructions: All comments received must include the docket number for this rulemaking. All comments received will be posted to https://www.regulations.gov, including any personal information provided. If you cannot submit your comment using https://www.regulations.gov, contact the person in the FOR FURTHER INFORMATION CONTACT section of this proposed rule for alternate instructions. For detailed instructions on sending comments and additional information on the types of comments that are of particular interest to CISA for this proposed rulemaking, see the “Public Participation” heading of the SUPPLEMENTARY INFORMATION section of this document. Docket: For access to the docket and to read background documents mentioned in this proposed rule and comments received, go to https://www.regulations.gov. FOR FURTHER INFORMATION CONTACT: Todd Klessman, CIRCIA Rulemaking Team Lead, Cybersecurity and Infrastructure Security Agency, circia@cisa.dhs.gov, 202-964-6869. SUPPLEMENTARY INFORMATION: Table of Contents I. Public Participation II. Executive Summary A. Purpose and Summary of the Regulatory Action B. Summary of Costs and Benefits III. Background and Purpose A. Legal Authority B. Current Cyber Incident Reporting Landscape C. Purpose of Regulation i. Purposes of the CIRCIA Regulation ii. How the Regulatory Purpose of CIRCIA Influenced the Design of the Proposed CIRCIA Regulation D. Harmonization Efforts E. Information Sharing Required by CIRCIA F. Summary of Stakeholder Comments i. General Comments ii. Comments on the Definition of Covered Entity iii. Comments on the Definition of Covered Cyber Incident and Substantial Cyber Incident iv. Comments on Other Definitions v. Comments on Criteria for Determining Whether the Domain Name System Exception Applies vi. Comments on Manner and Form of Reporting, Content of Reports, and Reporting Procedures vii. Comments on the Deadlines for Submission of CIRCIA Reports viii. Comments on Third-Party Submitters ix. Comments on Data and Records Preservation Requirements x. Comments on Other Existing Cyber Incident Reporting Requirements and the Substantially Similar Reporting Exception xi. Comments on Noncompliance and Enforcement xii. Comments on Treatment and Restrictions on Use of CIRCIA Reports IV. Discussion of Proposed Rule A. Definitions i. Covered Entity ii. Cyber Incident, Covered Cyber Incident, and Substantial Cyber Incident iii. CIRCIA Reports iv. Other Definitions v. Request for Comments on Proposed Definitions B. Applicability i. Interpreting the CIRCIA Statutory Definition of Covered Entity ii. Determining if an Entity Is in a Critical Infrastructure Sector iii. Clear Description of the Types of Entities That Constitute Covered Entities Based on Statutory Factors iv. Explanation of Specific Proposed Applicability Criteria v. Other Approaches Considered To Describe Covered Entity vi. Request for Comments on Applicability Section C. Required Reporting on Covered Cyber Incidents and Ransom Payments i. Overview of Reporting Requirements ii. Reporting of Single Incidents Impacting Multiple Covered Entities D. Exceptions to Required Reporting on Covered Cyber Incidents and Ransom Payments i. Substantially Similar Reporting Exception ii. Domain Name System (DNS) Exception iii. Exception for Federal Agencies Subject to Federal Information Security Modernization Act Reporting Requirements E. Manner, Form, and Content of Reports i. Manner of Reporting ii. Form for Reporting iii. Content of Reports iv. Timing of Submission of CIRCIA Reports v. Report Submission Procedures vi. Request for Comments on Proposed Manner, Form, and Content of Reports F. Data and Records Preservation Requirements i. Types of Data That Must Be Preserved ii. Required Preservation Period iii. Data Preservation Procedural Requirements iv. Request for Comments on Proposed Data Preservation Requirements G. Enforcement i. Overview ii. Request for Information iii. Subpoena iv. Service of an RFI, Subpoena, or Notice of Withdrawal v. Enforcement of Subpoenas vi. Acquisition, Suspension, and Debarment Enforcement Procedures vii. Penalty for False Statements and Representations viii. Request for Comments on Proposed Enforcement H. Protections i. Treatment of Information and Restrictions on Use ii. Protection of Privacy and Civil Liberties iii. Digital Security iv. Request for Comments on Proposed Protections I. Severability V. Statutory and Regulatory Analyses A. Regulatory Planning and Review i. Number of Reports ii. Industry Cost iii. Government Cost iv. Combined Costs v. Benefits vi. Accounting Statement vii. Alternatives B. Small Entities C. Assistance for Small Entities D. Collection of Information E. Federalism F. Unfunded Mandates Reform Act G. Taking of Private Property H. Civil Justice Reform I. Protection of Children J. Indian Tribal Governments K. Energy Effects L. Technical Standards M. National Environmental Policy Act VI. Proposed Regulation List of Tables Table 1: Affected Population, by Criteria Table 2: Number of CIRCIA Reports, Primary Estimate Table 3: Number of CIRCIA Reports Table 4: Familiarization Cost by Entity Type, Primary Estimate Table 5: Total Familiarization Costs ($ Millions, Undiscounted) Table 6: Cost of CIRCIA Reporting Table 7: Data and Record Preservation Costs Table 8: Industry Cost Range, ($ Millions, Undiscounted) Table 9: Total Industry Cost, Primary Estimate ($ Millions) Table 10: Cost by Covered Entity Criteria, ($ Millions, Undiscounted) Table 11: Government Cost ($ Millions) Table 12: Combined Industry and Government Cost, Primary Estimate ($ Millions) Table 13: Combined Industry and Government Cost Range, ($ Millions) Table 14: Summary of Cyber Event Losses and Counts, IRIS 2022 Table 15: OMB A-4 Accounting Statement ($ Millions, 2022 Dollars) Table 16: Alternative 1 Industry Cost, Primary Estimate ($ Millions) Table 17: Alternative 1 Combined Industry and Government Cost, Primary Estimate, ($ Millions) Table 18: Alternative 2 Industry Cost, Primary Estimate ($ Millions) Table 19: Alternative 2 Combined Industry and Government Cost, Primary Estimate ($ Millions) Table 20: Alternative 3 Industry Cost, Primary Estimate ($ Millions) Table 21: Alternative 3 Combined Industry and Government Cost, Primary Estimate ($ Millions) Table 22: Affected Population by Critical Infrastructure Sector Table 23: Alternative 4 Industry Cost, Primary Estimate ($ Millions) Table 24: Alternative 4 Combined Industry and Government Costs, Primary Estimate ($ Millions) Table 25: Alternatives Summary, Combined Industry and Government Cost, Primary Estimate ($ Millions) Abbreviations and Acronyms Frequently Used in This Document ARIN American Registry for Internet Numbers ATO Authority to Operate BES Bulk Electric System CFATS Chemical Facility Anti-Terrorism Standards CFTC Commodity Futures Trading Commission CHS U.S. House Committee on Homeland Security CIA Confidentiality, Integrity, and Availability CIP Critical Infrastructure Protection CIRC Cyber Incident Reporting Council CIRCIA Cyber Incident Reporting for Critical Infrastructure Act of 2022, as amended CISA Cybersecurity and Infrastructure Security Agency CSP Cloud Service Provider DFARS Defense Federal Acquisition Regulation Supplement DHS Department of Homeland Security DNS Domain Name System DOD Department of Defense DOE Department of Energy DOJ Department of Justice EPA Environmental Protection Agency ESA Educational Service Agency FBI Federal Bureau of Investigation FCC Federal Communications Commission FDA Food and Drug Administration FDIC Federal Deposit Insurance Corporation FedRAMP Federal Risk and Authorization Management Program FERC Federal Energy Regulatory Commission FHFA Federal Housing Finance Agency FICU Federally Insured Credit Union FISMA Federal Information Security Modernization Act of 2014 FOIA Freedom of Information Act FRB Federal Reserve Board GAO Government Accountability Office GCC Government Coordinating Council GSA General Services Administration gTLD Generic Top-Level Domain HHS Department of Health and Human Services HIPAA Health Insurance Portability and Accountability Act of 1996 HITECH Health Information Technology for Economic and Clinical Health HSGAC U.S. Senate Committee on Homeland Security and Governmental Affairs IANA Internet Assigned Numbers Authority ICANN Internet Corporation for Assigned Names and Numbers ICT Information and Communications Technology IHE Institute of Higher Education IP Internet Protocol ISAC Information Sharing and Analysis Center IT Information Technology K-12 Kindergarten through 12th Grade LEA Local Educational Agency MTSA Maritime Transportation Security Act NAICS North American Industry Classification System NCF National Critical Function NCUA National Credit Union Administration NERC North American Electric Reliability Corporation NIPP National Infrastructure Protection Plan NIST National Institute of Standards and Technology NORS Network Outage Reporting System NPRM Notice of Proposed Rulemaking NRC Nuclear Regulatory Commission NSA National Security Agency OCC Office of the Comptroller of the Currency OEM Original Equipment Manufacturer OMB Office of Management and Budget OT Operational Technology OTRB Over-the-Road Bus POTW Publicly Owned Treatment Works PPD Presidential Policy Directive PRA Paperwork Reduction Act PTPR Public Transportation and Passenger Railroads RFI Request for Information RIR Regional Internet Registry RTR Research and Test Reactor RSO Root Server Operator SBA Small Business Administration SCC Sector Coordinating Council SEA State Educational Agency SEC Securities and Exchange Commission SLTT State, Local, Tribal, or Territorial SRMA Sector Risk Management Agency SSP Sector-Specific Plan TLD Top-Level Domain TSA Transportation Security Administration TTP Tactics, Techniques, and Procedures USCG United States Coast Guard USDA United States Department of Agriculture VoIP Voice over Internet Protocol I. Public Participation The Cybersecurity and Infrastructure Security Agency (CISA) views public participation as essential to effective rulemaking and invites interested persons to participate by submitting data, comments, and other information on the content and assumptions made in this proposed rule. Your comments can help shape the outcome of this rulemaking. CISA is particularly interested in comments on the following: a. Proposed Definitions. The proposed definition of covered cyber incident and the other definitions CISA is proposing to include in the regulation (see proposed § 226.1 and Section IV.A in this document); b. Applicability. The proposed description of covered entity, the scope of entities to whom this regulation applies (see proposed § 226.2 and Section IV.B in this document); c. Examples of Reportable Covered Cyber Incidents. The examples of substantial cyber incidents included in this Notice of Proposed Rulemaking (NPRM) (see Section IV.A.ii.3.e in this document); d. CIRCIA Reporting Requirements and Procedures. The proposed reporting requirements and procedures for CIRCIA Reports, specifically the manner, form, and content of CIRCIA Reports (see proposed §§ 226.6 through 226.12 and Section IV.E.i-iii in this document), including CISA's proposal to use a single, dynamic, web-based form as the primary means of submission for all CIRCIA Reports (see Section IV.E.i.2 in this document); e. Proposed CIRCIA Report Submission Deadlines. The proposed deadlines for submitting CIRCIA Reports and CISA's proposed interpretations of these submission deadline requirements (see proposed § 226.5 and Section IV.E.iv in this document); f. Data and Records Preservation Requirements. The proposed data and records preservation requirements and preservation period (see proposed § 226.13 and Section IV.F in this document); g. Enforcement Procedures. The proposed enforcement procedures, including the procedures related to issuance of a Request for Information (RFI) or subpoena and the proposed subpoena withdrawal and appeals process (see proposed §§ 226.14 through 226.17 and Section IV.G in this document); h. Treatment of Information and Restrictions on Use. The proposed rules governing the protections and restrictions on the use of CIRCIA Reports, information included in such reports, and responses to RFIs (see proposed § 226.18 and Section IV.H.i in this document); and i. Procedures for Protecting Privacy and Civil Liberties. The proposed procedures governing the protection of personal information contained in CIRCIA Reports and responses to RFIs (see proposed § 226.19 and Section IV.H.ii in this document), which are further described in the draft Privacy and Civil Liberties Guidance for CIRCIA (this draft document is available in the docket for this proposed regulatory action (CISA-2022-0010)). CISA is including in the docket a draft privacy and civil liberties guidance document that would apply to CISA's retention, use, and dissemination of personal information contained in a CIRCIA Report and guide other Federal departments and agencies with which CISA will share CIRCIA Reports. CISA encourages interested readers to review this draft guidance and to submit comments on it. Commenters should clearly identify which specific comment(s) concern the draft guidance document. CISA will accept comments no later than the date provided in the DATES section of this document. Interested parties may submit data, comments, and other information using any of the methods described in the ADDRESSES section of this document. To ensure appropriate consideration of your comment, indicate the specific section of this proposed rule and, if applicable, the specific comment request number associated with the topic to which each comment applies; explain a reason for any suggestion or recommendation; and include data, information, or authority that supports the recommended course of action. Comments submitted in a manner other than those described above, including emails or letters sent to Department of Homeland Security (DHS) or CISA officials, will not be considered comments on the proposed rule and may not receive a response from CISA. Instructions to Submit Comments. If you submit a comment, you must submit it to the docket associated with CISA Docket Number CISA-2022-0010. All submissions may be posted, without change, to the Federal eRulemaking Portal at www.regulations.gov and will include any personal information that you provide. You may choose to submit your comment anonymously. Additionally, you may upload or include attachments with your comments. Do not upload any material in your comments that you consider confidential or inappropriate for public disclosure. Do not submit comments that include trade secrets, confidential commercial or financial information, Protected Critical Infrastructure Information, Sensitive Security Information, or any other protected information to the public regulatory docket. Please submit comments containing protected information separately from other comments by contacting the individual listed in the FOR FURTHER INFORMATION CONTACT section of this document for instructions on how to submit comments that include protected information. CISA will not place comments containing protected information in the public docket and will handle them in accordance with applicable safeguards and restrictions on access. CISA will hold such comments in a separate file to which the public does not have access and place a note in the public docket documenting receipt. If CISA receives a request for a copy of any comments submitted containing protected information, CISA will process such a request consistent with the Freedom of Information Act (FOIA), 5 U.S.C. 552, and the Department's FOIA regulation found in part 5 of title 6 of the Code of Federal Regulations (CFR). To submit a comment, go to www.regulations.gov, type CISA-2022-0010 in the search box and click “Search.” Next, look for this Federal Register notice of proposed rulemaking in the Search Results column, and click on it. Then click on the Comment option. If you cannot submit your comment by using https://www.regulations.gov, call or email the point of contact in the FOR FURTHER INFORMATION CONTACT section of this document for alternate instructions. Viewing material in docket. For access to the docket and to view documents mentioned in this NPRM as being available in the docket, go to https://www.regulations.gov, search for the docket number provided in the previous paragraph, and then select “Supporting & Related Material” in the Document Type column. Public comments will also be placed in the docket and can be viewed by following instructions on the Frequently Asked Questions web page https://www.regulations.gov/faq. The Frequently Asked Questions page also explains how to subscribe for email alerts that will notify you when comments are posted or if another Federal Register document is published. CISA will review all comments received. CISA may choose to withhold information provided in comments from public viewing or to not post comments that CISA determines are off-topic or inappropriate. Public meeting. CISA does not plan to hold additional public meetings at this time, but may consider doing so if CISA determines from public comments that a meeting would be helpful. If CISA decides to hold a public meeting, a notice announcing the date, time, and location for the meeting will be issued in a separate Federal Register notice. II. Executive Summary A. Purpose and Summary of the Regulatory Action On March 15, 2022, the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) was signed into law. See 6 U.S.C. 681-681g; Public Law 117-103, as amended by Public Law 117-263 (Dec. 23, 2022). CIRCIA requires covered entities to report to CISA within certain prescribed timeframes any covered cyber incidents, ransom payments made in response to a ransomware attack, and any substantial new or different information discovered related to a previously submitted report. 6 U.S.C. 681b(a)(1)-(3). CIRCIA further requires the Director of CISA to implement these new reporting requirements through rulemaking, by issuing an NPRM no later than March 15, 2024, and a final rule within 18 months of publication of the NPRM. 6 U.S.C. 681b(b). CISA is issuing this NPRM to solicit public comment on proposed regulations that would codify these reporting requirements. This NPRM is divided into six sections. Section I—Public Participation describes the process for members of the public to submit comments on the proposed regulations and lists specific topics on which CISA is particularly interested in receiving public comment. Section II—Executive Summary contains a summary of the proposed regulatory action and the anticipated costs and benefits of the proposed regulations. Section III—Background and Purpose contains a summary of the legal authority for this proposed regulatory action; an overview of the current regulatory cyber incident reporting landscape; a description of the purpose of the proposed regulations; a discussion of efforts CISA has taken to harmonize these proposed regulations with other Federal cyber incident reporting regulations; a discussion of information sharing activities related to the proposed regulations; and a summary of the comments CISA received in response to an RFI issued by CISA on approaches to the proposed regulations and during listening sessions hosted by CISA on the same topic. Section IV—Discussion of Proposed Rule includes a detailed discussion of the proposed rule, the justification for CISA's specific proposals, and the alternatives considered by CISA. Section V—Statutory and Regulatory Analyses contains the analyses that CISA is required by statute or Executive Order to perform as part of the rulemaking process prior to issuance of the final rule, such as the Initial Regulatory Flexibility Analysis and Unfunded Mandates Reform Act analysis. Section VI contains the proposed regulatory text. The proposed rule is comprised of 20 sections, §§ 226.1 through 226.20, beginning with a section containing definitions for a number of key terms used throughout the proposed regulation. Among other definitions, § 226.1 includes proposed definitions for the terms used to describe and ultimately scope what types of incidents must be reported to CISA ( i.e., cyber incident, covered cyber incident, ransom payment, and substantial cyber incident) and the term used to describe the different types of reports that must be submitted ( i.e., CIRCIA Reports). The next section of the proposed rule, § 226.2, describes the applicability of the proposed rule to certain entities in a critical infrastructure sector, i.e., those entities that are considered covered entities and to whom the operative provisions of the rule would apply. The next section of the proposed rule, § 226.3, describes the circumstances under which a covered entity must submit a CIRCIA Report to CISA. This includes when a covered entity experiences a covered cyber incident, makes a ransom payment, has another entity make a ransom payment on its behalf, or acquires substantial new or different information after submitting a previous CIRCIA Report. See § 226.3; Section IV.C in this document. CISA is proposing three exceptions to these reporting requirements for covered entities, which are in § 226.4 of the proposed regulation and described in Section IV.D in this document. These exceptions include when a covered entity reports substantially similar information in a substantially similar timeframe to another Federal agency pursuant to an existing law, regulation, or contract when a CIRCIA Agreement is in place between CISA and the other Federal agency; when an incident impacts certain covered entities related to the Domain Name System (DNS); and when Federal agencies are required by the Federal Information Security Modernization Act of 2014 (FISMA) to report incidents to CISA. See § 226.4 of the proposed regulation and Section IV.D of this document. Section 226.5 of the proposed regulation contains the submission deadlines for the four different types of CIRCIA Reports ( i.e., Covered Cyber Incident Reports; Ransom Payment Reports; Joint Covered Cyber Incident and Ransom Payment Reports; Supplemental Reports). These deadlines, including how to calculate them, are discussed further in Section IV.E.iv in this document. Section 226.6 of the proposed regulation sets forth the proposed manner and form of reporting, which CISA proposes to be through a web-based CIRCIA Incident Reporting Form available on CISA's website or in any other manner and form of reporting approved by the Director. Additional details on the proposed manner and form of reporting and related submission procedures are contained in Sections IV.E.i, ii and v in this document. The information CISA proposes that covered entities must include in each of the four types of CIRCIA Reports is enumerated in §§ 226.7 through 226.11 and expanded upon in Section IV.E.iii in this document. A covered entity may use a third party to submit a CIRCIA Report to CISA on the covered entity's behalf to satisfy the covered entity's reporting obligations. See 6 U.S.C. 681b(d). The proposed procedures and requirements for using a third party to submit a CIRCIA Report on behalf of the covered entity are contained in § 226.12 of the proposed regulations and discussed in detail in Section IV.E.v.3 in this document. The proposed regulation also affirms the statutorily mandated obligation for a third party to advise the covered entity of its ransom payment reporting obligations under CIRCIA when the third party knowingly makes a ransom payment on behalf of a covered entity. See 6 U.S.C. 681b(d)(4), § 226.12(d) of the proposed regulations, and Section IV.E.v.3.e of the NPRM. Section 226.13 of the proposed regulation sets forth the proposed data and records preservation requirements. It includes a recitation of the types of data and records that a covered entity must preserve; the required preservation period; the format or form in which the data and records must be preserved; and the storage, protection, and allowable uses of the preserved data and records. See § 226.13 and Section IV.F in this document. CIRCIA authorizes CISA to use various mechanisms to obtain information from a covered entity about a covered cyber incident or ransom payment that was not reported in accordance with CISA's proposed regulatory reporting requirements. 6 U.S.C. 681d. These mechanisms include the issuance of an RFI; the issuance of a subpoena; a referral to the Attorney General to bring a civil action in District Court to enforce a subpoena; and acquisition, suspension, and debarment enforcement procedures. The proposed procedures for each of these enforcement mechanisms are contained in §§ 226.14 through 226.17 of the proposed regulation and discussed in Section IV.G.i-vi in this document. CIRCIA provides a variety of requirements related to the treatment and restrictions on the use of CIRCIA Reports, information contained in such reports, as well as information submitted in response to an RFI. See 6 U.S.C. 681e(b), 681e(a)(1), (5). CIRCIA also provides liability protection for the submission of a CIRCIA Report in compliance with the reporting requirements established in the CIRCIA regulation. 6 U.S.C. 681e(c). To ensure that such requirements related to the treatment and restrictions on the use of CIRCIA Reports are applied consistently, CISA proposes to include them in § 226.18, as discussed in Section IV.H.i in this document. CISA additionally proposes steps to minimize the collection of unnecessary personal information in CIRCIA Reports and additional procedures for protecting privacy and civil liberties related to the submission of CIRCIA Reports and responses to RFIs. These proposed procedures for protecting privacy and civil liberties are contained in § 226.19 of the proposed regulation and discussed further in Section IV.H.ii in this document as well as in the guidance document posted to the docket for this proposed rule. The final section of the proposed regulation, § 226.20, proposes two distinct procedural provisions. The first proposed provision provides that any person who knowingly and willfully makes a materially false or fraudulent statement or representation in connection with, or within, a CIRCIA Report, RFI response, or reply to an administrative subpoena is subject to penalties under 18 U.S.C. 1001. § 226.20(a). The second proposed provision is a severability clause, which states CISA intends the various provisions of this part to be severable from each other to the extent practicable, such that if a court of competent jurisdiction were to vacate or enjoin any one provision, the other provisions remain in effect unless they are dependent upon the vacated or enjoined provision. § 226.20(b). These are discussed in Sections IV.G.vii and IV.I in this document, respectively. B. Summary of Costs and Benefits CISA estimates the cost of this proposed rule would be $2.6 billion over the period of analysis 1 (undiscounted). CISA estimates that there will be 316,244 entities potentially affected by the proposed rule ( i.e., covered entities) who collectively will submit an estimated total of 210,525 CIRCIA Reports over the period of analysis, resulting in $1.4 billion (undiscounted) in cost to industry and $1.2 billion (undiscounted) in cost to the Federal Government. The cost over the period of analysis discounted at 2% would be $2.4 billion ($1.3 billion for industry, $1.1 billion for government), with an annualized cost of $244.6 million, as presented in the Preliminary Regulatory Impact Analysis (RIA) included in the docket. The main industry cost drivers of this proposed rule are the initial costs associated with becoming familiar with the proposed rule, followed by the recurring data and records preservation requirements, and then reporting requirements. Other industry costs include those associated with help desk calls and enforcement actions. Government costs include costs CISA anticipates incurring associated with the creation, implementation, and operation of the government infrastructure needed to run the CIRCIA program. This includes both personnel and technology costs necessary to support the receipt, analysis, and sharing of information from CIRCIA Reports submitted to CISA. 1 CISA used an 11-year period of analysis spanning from 2023-2033 to reflect that CISA began incurring costs related to CIRCIA implementation in 2023, one year prior to the publication of the NPRM. See the Executive Summary section of the CIRCIA Regulation Proposed Rulemaking Preliminary Regulatory Impact Analysis and Initial Regulatory Flexibility Analysis for additional detail on the period of analysis. The Preliminary RIA also discusses the qualitative benefits of the proposed rule. From a qualitative benefits perspective, the proposed reporting requirements, analytical activities, and information sharing will lead to Federal and non-Federal stakeholders having the ability to adopt an enhanced overall level of cybersecurity and resiliency, resulting in direct, tangible benefits to the nation. For example: • By supporting CISA's ability to share information that will enable non-Federal and Federal partners to detect and counter sophisticated cyber campaigns earlier with the potential for significant avoided or minimized negative impacts to critical infrastructure or national security, CIRCIA's mandatory reporting requirements reduce the risks associated with those campaigns. • By facilitating the identification and sharing of information on exploited vulnerabilities and measures that can be taken to address those vulnerabilities, incident reporting enables entities with unremediated and unmitigated vulnerabilities on their systems to take steps to remedy or mitigate those vulnerabilities before they also fall victim to cyberattack. • By supporting sharing of information about common threat actor tactics, techniques, and procedures with the IT community, cyber incident reporting will enable software developers and vendors to develop more secure products or send out updates to add security to existing products, better protecting end users. • By enabling rapid identification of ongoing incidents and increased understanding of successful mitigation measures, incident reporting increases the ability of impacted entities and the Federal government to respond to ongoing campaigns faster and mitigate or minimize the consequences that could result from them. • Law enforcement entities can use the information submitted in reports to investigate, identify, capture, and prosecute perpetrators of cybercrime, getting malicious cyber actors off the street and deterring future actors. • By contributing to a more accurate and comprehensive understanding of the cyber threat environment, incident reporting allows for CISA's Federal and non-Federal stakeholders to more efficiently and effectively allocate resources to prevent, deter, defend against, respond to, and mitigate significant cyber incidents. These benefits, which stem from CISA receiving cyber incident and ransom payment reporting for aggregation, analysis, and information sharing, directly contribute to a reduction in economic, health, safety, and security consequences associated with cyber incidents by reducing the number of cyber incidents successfully perpetrated and mitigating the consequences of those cyber incidents that are successful by catching them earlier. It is worth noting that these benefits are not limited to covered entities required to report under CIRCIA, but also inure to entities not subject to CIRCIA's reporting requirements as they too will receive the downstream benefits of enhanced information sharing, more secure technology products, and an ability to better defend their networks based on sector-specific and cross-sector understandings of the threat landscape. CISA also anticipates qualitative benefits stemming from the data and record preservation requirements of this proposed rule. The preservation of data and records in the aftermath of a covered cyber incident serves a number of critical purposes, such as supporting the ability of analysts and investigators to understand how a cyber incident was perpetrated and by whom. III. Background and Purpose A. Legal Authority On March 15, 2022, the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) was signed into law. See 6 U.S.C. 681-681g; Public Law 117-103, as amended by Public Law 117-263 (Dec. 23, 2022). CIRCIA requires covered entities to report to CISA covered cyber incidents within 72 hours after the covered entity reasonably believes that the covered cyber incident has occurred and ransom payments made in response to a ransomware attack within 24 hours after the ransom payment has been made. 6 U.S.C. 681b(a). Among other benefits, this new authority will enhance CISA's ability to identify trends and track cyber threat activity across the cyber threat landscape beyond the Federal agencies that are already required to report information on certain cyber incidents to CISA pursuant to the FISMA, 44 U.S.C. 3554(b)(7)(C)(ii) and 6 U.S.C. 652(c)(3). CIRCIA requires the Director of CISA to implement these new reporting requirements through rulemaking, by issuing a Notice of Proposed Rulemaking no later than March 15, 2024, and a final rule within 18 months of the NPRM's publication. 6 U.S.C. 681b(b). CIRCIA also authorizes CISA to request information and engage in administrative enforcement actions to compel a covered entity to disclose information if it has failed to comply with its reporting obligations. 6 U.S.C. 681d. CIRCIA establishes information treatment requirements and restrictions on use, including certain protections against liability and exemptions from public disclosure, for required reports and information submitted to CISA. 6 U.S.C. 681e, 681d(b)(2), 681c(c). CIRCIA also provides for Federal interagency coordination and sharing of information on cyber incidents, including ransomware attacks, reported to Federal departments and agencies, and covered cyber incidents and ransom payments reported to CISA. 6 U.S.C. 681a(a)(10), (b), 681g. Although CIRCIA requires CISA to implement new reporting requirements through regulation, CISA's rulemaking authority under CIRCIA does not supersede, abrogate, modify, or otherwise limit any authority to regulate or act with respect to the cybersecurity of an entity vested in any United States Government officer or agency. 6 U.S.C. 681b(h). Therefore, covered entities that are obligated to report covered cyber incidents or ransom payments pursuant to another Federal regulatory requirement, directive, or similar mandate will remain obligated to do so even if the reporting requirements differ from those established by CIRCIA. Where CIRCIA imposes regulatory requirements that may overlap or duplicate other Federal regulatory requirements, CISA is committed to working with other Federal partners to explore options to minimize unnecessary duplication between CIRCIA's reporting requirements and other Federal cyber incident reporting requirements and welcomes public comment regarding options to minimize unnecessary duplication or identification of specific Federal cyber incident reporting requirements where such duplication is likely to occur. Additionally, CIRCIA does not permit or require a provider of a remote computing service or electronic communication service to the public to disclose information not otherwise permitted or required to be disclosed under 18 U.S.C. 2701-2713 (commonly known as the “Stored Communications Act”). 6 U.S.C. 681e(e). CIRCIA also provides that entities may voluntarily report cyber incidents or ransom payments to CISA that are not required to be reported under the CIRCIA regulations, and applies the same information treatment requirements on use (including liability protections) and restrictions on use to such voluntarily submitted reports. 6 U.S.C. 681c(a), (c); 681e. CISA is not, however, proposing to address entirely voluntary reporting ( e.g., how such reports may be submitted) in this rulemaking. B. Current Cyber Incident Reporting Landscape The cyber incident reporting landscape currently consists of dozens of Federal and state, local, tribal, or territorial (SLTT) cyber incident reporting requirements that may apply to entities operating within the United States, depending on where an entity or its customers are located and the type of business in which the entity is engaged. At the Federal level alone, more than three dozen different cyber incident reporting requirements currently are in effect, with a number of additional proposed regulatory reporting requirements in various stages of development. At the SLTT level, the District of Columbia, Puerto Rico, the Virgin Islands, Guam, and all 50 states have laws that require reporting and/or public disclosure of at least some cyber incidents that result in data breaches. Despite these myriad Federal and SLTT reporting requirements, prior to the enactment of CIRCIA, there was no Federal statute or regulation supporting a comprehensive and coordinated approach to understanding cyber incidents across critical infrastructure sectors. Nor was there a Federal department or agency charged with coordinating cross-sector sharing of information related to cyber incidents with Federal and non-Federal stakeholders. Indeed, during the lead up to the passage of CIRCIA, Congress stated “[t]oday no one U.S. Government agency has visibility into all cyber-attacks occurring against U.S. critical infrastructure on a daily basis. This bill would change that—enabling a coordinated, informed U.S. response to the foreign governments and criminal organizations conducting these attacks against the U.S.” 2 The enactment of CIRCIA authorized CISA to fill these key gaps in the current cyber incident reporting landscape. 2 U.S. Senate Committee on Homeland Security and Governmental Affairs (HSGAC), Cyber Incident Reporting for Critical Infrastructure Act at 1 (Dec. 17, 2021), available at https://www.hsgac.senate.gov/wp-content/uploads/imo/media/doc/Overview%20of%20Cyber%20Incident%20Reporting%20Legislation.pdf (hereinafter, “ HSGAC Fact Sheet” ). There are a number of different reasons why a government entity may establish cyber incident reporting requirements. A recent DHS report to Congress based on the work of the Cyber Incident Reporting Council (CIRC) 3 titled Harmonization of Cyber Incident Reporting to the Federal Government suggests that these reasons generally can be organized into two primary categories. 4 The first category consists of regulations primarily focused on national security, economic security, public health and safety, and/or the resiliency of National Critical Functions (NCFs). A majority of Federal reporting regimes appear to be solely or primarily animated by these concerns. The remaining Federal cyber incident reporting regimes, as well as virtually all SLTT cyber incident reporting regimes, are designed primarily to address privacy, consumer protection, or investor protection considerations. This second category includes all the reporting regimes often referred to as data breach notification laws. 3 CIRCIA established an intergovernmental Cyber Incident Reporting Council. Chaired by the Secretary of Homeland Security, the CIRC is responsible for coordinating, deconflicting, and harmonizing Federal incident reporting requirements, including those issued through regulations. 6 U.S.C. 681f. 4 Department of Homeland Security, Harmonization of Cyber Incident Reporting to the Federal Government at 5 (Sept. 19, 2023), available at https://www.dhs.gov/publication/harmonization-cyber-incident-reporting-federal-government (hereinafter, “ the DHS Report” ). Outside of state data breach notification laws, most existing cyber incident reporting requirements target specific communities with common characteristics. Some focus on entities within a specific industry or sector ( e.g., commercial nuclear power reactors; financial services institutions) while others cover entities across sectors that possess certain shared characteristics ( e.g., entities possessing threshold quantities of certain chemicals of interest that render those entities high-risk of being targeted by terrorists; entities located upon navigable bodies of water where they present the risk of a transportation security incident; entities that maintain personal health-related records). Central aspects of cyber incident reporting regimes, such as what constitutes a reportable incident, the process for reporting an incident, which entity receives the report, what information must be reported, and how long an entity has to report the incident, can vary widely from regime to regime, with the purpose of the regime frequently impacting these variables. For instance, reporting regimes focused on national or economic security tend to have shorter deadlines for reporting than those regimes focused on privacy or consumer protections. Similarly, reporting regimes focused on national or economic security almost universally require reporting to a Federal department or agency, while regimes with a primary purpose of privacy or consumer protections often require reporting to the impacted individual and sometimes credit reporting agencies, instead of, or in addition to, reporting to the governing Federal or SLTT entity. Given the number and variety of different cyber incident reporting regimes, and their continued evolution, CISA does not intend to describe each one of them as part of this section. Instead, CISA is providing the following brief summaries of some of the major regulatory programs that require reporting of cyber incidents and that are concerned at least in part with national security, economic security, public safety, and/or the resiliency of NCFs: 5 5 Individuals interested in learning more about existing Federal cyber incident reporting requirements are encouraged to review the Federal Cyber Incident Reporting Requirements Inventory contained in Appendix B of the DHS Report, supra note 4. • Chemical Facility Anti-Terrorism Standards (CFATS). CISA's CFATS program worked for the prior 16 years to identify and regulate high-risk chemical facilities to ensure security measures are in place to reduce the risk of certain chemicals of interest from being weaponized by terrorists. See 6 CFR part 27. Under CFATS Risk-Based Performance Standard 15, CFATS-covered facilities were expected to establish protocols governing the identification and reporting of significant cyber incidents to the appropriate facility personnel, local law enforcement, and/or CISA. On July 28, 2023, the statutory authority for the CFATS program expired, but CISA anticipates that CFATS will be reauthorized prior to the publication of the CIRCIA Final Rule. • Defense Federal Acquisition Regulation Supplement (DFARS). Pursuant to 32 CFR 236.1-236.7 and 48 CFR 252.204-7012, Department of Defense (DOD) contractors must report to DOD all cyber incidents (1) involving covered defense information on their covered contractor information systems or (2) affecting the contractor's ability to provide operationally critical support. Contractors subject to these requirements, who are members of the Defense Industrial Base sector, must report cyber incidents to DOD at https://dibnet.dod.mil. • Department of Energy (DOE) DOE-417 reporting requirements. DOE's Office of Cybersecurity, Energy Security, and Emergency Response requires certain Energy Sector entities to report certain cybersecurity incidents to DOE pursuant to 15 U.S.C. 772(b). Entities subject to the reporting requirements include Balancing Authorities, Reliability Coordinators, some Generating Entities, and Electric Utilities, including those located in Puerto Rico, the Virgin Islands, Guam, or other U.S. possessions. • Federal Communications Commission's (FCC) Network Outage Reporting System (NORS) Requirements. Under 47 CFR part 4, providers of telecommunications services and Voice over internet Protocol (VoIP) providers are required to report to the FCC communications service outages, including those caused by cyber incidents, that meet certain minimum requirements for duration and magnitude. The goal of this regulation, which applies to wireline, wireless, VoIP, cable, satellite, Signaling System 7, submarine cable, covered 911 service, and covered 988 service providers, is to provide rapid, complete, and accurate information on service disruptions that could affect homeland security, public health or safety, and the economic well-being of the Nation and help ensure the public's access to emergency services. • Federal Information Security Modernization Act of 2014. FISMA requires Federal civilian departments and agencies to report cybersecurity incidents to CISA within one hour of discovery. 6 CISA uses information received in FISMA incident reports to, among other things, provide technical assistance to victims of cyber incidents, compile and analyze incident information to identify cyber threats and vulnerabilities, and share guidance with others on how to detect, handle, and prevent similar incidents. 7 Federal agencies are also required to report major incidents under FISMA and pursuant to OMB Guidance, including those that implicate personal information. 8 6 44 U.S.C. 3554(b)(7)(C)(ii). 7 44 U.S.C. 3556(a). 8 44 U.S.C. 3554(b)(7)(C)(iii). • Federal Risk and Authorization Management Program (FedRAMP). FedRAMP requires any cloud service providers (CSPs) with a Federal agency-issued Authority to Operate (ATO) or a FedRAMP-issued provisional ATO to report suspected and confirmed information security incidents to the FedRAMP Program Management Office within the General Services Administration (GSA), CISA, and the affected agency. 9 9 See FedRAMP, GSA, https://www.gsa.gov/technology/government-it-initiatives/fedramp (last visited Nov. 27, 2023). • Financial Services Sector Regulations. Most of the primary Financial Services Sector regulators have adopted cyber incident reporting requirements for their regulated communities. Among other things, these reporting requirements have been established to help promote early awareness of emerging threats to banking organizations and the broader financial system, and to help the regulating entities react to these threats before they can cause systemic impacts across the financial system. Included among these are cyber incident reporting requirements managed by the Office of the Comptroller of the Currency (OCC) (12 CFR part 53), the Federal Reserve Board (FRB) (12 CFR part 225), the Federal Deposit Insurance Corporation (FDIC) (12 CFR part 304), the Commodity Futures Trading Commission (CFTC) (see, e.g., 17 CFR 38.1051 (designated contract markets); 17 CFR 37.1401 (swap execution facilities); 17 CFR 39.18 (derivatives clearing organizations); 17 CFR 49.24 (swap data repositories); 17 CFR 23.603 (swap dealers)), the National Credit Union Administration (NCUA) (12 CFR part 748), the Securities and Exchange Commission (SEC) (see, e.g., 17 CFR parts 229, 232, 239, 240, 242, and 249), and the Federal Housing Finance Agency (FHFA) (Advisory Bulletin 2020-05). • Maritime Transportation Security Act (MTSA). Under MTSA (33 CFR parts 104, 105, or 106) entities that own vessels or facilities, including outer continental shelf facilities, subject to MTSA must report cyber incidents to the U.S. Coast Guard's (USCG) National Response Center. These cyber incident reporting requirements are part of a larger suite of security requirements for vessels and facilities to identify, assess, and prevent transportation security incidents (TSIs) in the marine transportation system. USCG is also in the process of updating its maritime security regulations by adding cybersecurity requirements to existing Maritime Security regulations. 10 10 See Office of Management and Budget, Office of Information and Regulatory Affairs Unified Agenda, available at https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202304&RIN=1625-AC77. • North American Electric Reliability Corporation (NERC) Critical Infrastructure Protection (CIP) standard CIP-008-6: Cyber Security — Incident Reporting and Response Planning. Certain electric grid entities, designated as “responsible entities,” are required to report cyber incidents to both CISA and the Electricity Information Sharing and Analysis Center (ISAC), a component of NERC. See 18 CFR part 40 and CIP-008-6. The goal of these reporting requirements, which were developed pursuant to the authority granted NERC in Section 215 of the Federal Power Act (16 U.S.C. Ch 12, as amended through Pub. L. 115-325) to develop mandatory and enforceable reliability standards subject to Federal Energy Regulatory Commission (FERC) review and approval, is to mitigate the risk to the reliable operation of the Bulk Electric System (BES) as the result of a cybersecurity incident. • Nuclear Regulatory Commission (NRC) Cyber Security Event Notification Regulation. Owners and operators of commercial nuclear power reactors are required to report cyber incidents impacting safety, security, or emergency preparedness functions to the NRC. 11 11 10 CFR 73.77. • The Food and Drug Administration (FDA) Medical Device Regulations. Under section 519 of the Federal Food, Drug, and Cosmetic Act (21 U.S.C. 360i), as implemented by the Medical Device Reporting Regulations (21 CFR part 803) and the Medical Device Reports of Corrections and Removals Regulations (21 CFR part 806), manufacturers and importers must report certain device-related adverse events and product problems, including those caused by cyber incidents, to the FDA. For example, medical device manufacturers are required to report to the FDA when they learn that any of their devices may have caused or contributed to a death or serious injury. Manufacturers must also report to the FDA when they become aware that their device has malfunctioned and would be likely to cause or contribute to a death or serious injury if the malfunction were to recur. Medical device manufacturers and importers also must report to FDA any correction or removal of a medical device initiated to reduce a risk to health posed by the device or to remedy a violation of the Federal Food, Drug, and Cosmetic Act, including those caused by cyber incidents, caused by the device that may present a risk to health. A report must be made even if the event was caused by user error. • Transportation Security Administration (TSA) Security Directives and Security Program Amendments. TSA has issued several Security Directives and Security Program Amendments requiring various Transportation Systems Sector entities to report cybersecurity incidents to CISA. 12 These include, among other provisions, reporting requirements for certain passenger railroad carrier and rail transit systems, hazardous and natural gas pipeline owners and operators, freight railroad carriers, airport operators, aircraft operators, indirect air carriers, and Certified Cargo Screening Facilities. TSA is also in the process of codifying the requirements for surface transportation through a rulemaking (TSA's regulations provide for changes to aircraft operator security programs through an amendment process). 13 12 See, e.g., TSA Security Directive Pipeline-2021-01 series, Enhancing Pipeline Cybersecurity; TSA Security Directive 1580-21-01 series, Enhancing Rail Cybersecurity, available at https://www.tsa.gov/sd-and-ea. 13 See Office of Management and Budget, Office of Information and Regulatory Affairs Unified Agenda, available at https://www.reginfo.gov/public/do/eAgendaViewRule?pubId=202304&RIN=1652-AA74. C. Purpose of Regulation While the legislative history and statutory text shed some light on the goals that Congress hoped to achieve through this regulation, Congress did not include an explicit statement of purpose in CIRCIA. CISA believes considering the specific intended purpose behind a cyber incident reporting regulation during the development of the regulations is important as the purpose likely impacts key aspects of the regulation, such as what entities are required to report, what types of incidents must be reported, how quickly incidents must be reported, what information must be included in incident reports, and to whom the reports must be provided. Many stakeholders echoed this belief in remarks made during CIRCIA listening sessions or through comments provided in response to the CIRCIA RFI, which encouraged CISA to articulate the goals of the regulation to help inform the best regulatory proposal. 14 This section of the NPRM is intended to provide insight into what CISA interprets to be the purposes of the regulation that has informed the development of CISA's proposed regulation. 14 See 87 FR 55833 (Sept. 12, 2022); comments submitted by Information Technology Industry Council, CISA-2022-0010-0097 (“[I]t is vital that CISA articulate its tactical goals and/or plan for actualizing CIRCIA, as only upon understanding what CISA hopes to accomplish with these reports can industry stakeholders provide more specific commentary on key scoping and reporting threshold questions.”); National Grain and Feed Association, CISA-2022-0010-0104 (“CISA should also identify the specific purpose of reporting an incident. For example, if the data will be used by the government for trend identification.”); G. Rattray, CISA-2022-0010-0159 (“[CISA] will have to decide whether it is reporting that serves the purpose of characterizing threats or you're trying to understand risks and vulnerability. Both are probably viable analytically, but those would lead to different sort of reporting requirements.”). i. Purposes of the CIRCIA Regulation CIRCIA's legislative history indicates that the primary purpose of CIRCIA is to help preserve national security, economic security, and public health and safety. For example, in December 2021, HSGAC issued a fact sheet on the proposed legislation acknowledging the “serious national security threat” posed by cyberattacks and stating that CIRCIA would help enable a coordinated, informed U.S. response to the foreign governments and criminal organizations conducting these attacks against the United States. 15 Similarly, the U.S. House Committee on Homeland Security (CHS) issued a fact sheet on the proposed legislation stating that CIRCIA would provide CISA and its Federal partners the visibility needed to bolster cybersecurity, identify malicious cyber campaigns in early stages, identify longer-term threat trends, and ensure actionable cyber threat intelligence is getting to the first responders and Federal officials who need it. 16 15 HSGAC Fact Sheet, supra note 2, at 1. 16 CHS, The Cyber Incident Reporting for Critical Infrastructure Act at 1, 3 (Aug. 2021), available at https://democrats-homeland.house.gov/download/incident-reporting-bill-draft-fact-sheet (hereinafter, “ CHS Fact Sheet” ). The plain language that Congress used throughout CIRCIA reflects the purpose discussed in CIRCIA's legislative history. For example, CIRCIA requires CISA to review covered cyber incidents that are “likely to result in demonstrable harm to the national security interests, foreign relations, or economy of the United States or to the public confidence, civil liberties, or public health and safety of the people of the United States” and to “identify and disseminate ways to prevent or mitigate similar incidents in the future.” 6 U.S.C. 681(9); 6 U.S.C. 681a(a)(6). CIRCIA also requires CISA to “assess potential impact of cyber incidents on public health and safety,” and to consider, when describing covered entities, both “the consequences that disruption to or compromise of [a covered entity] could cause to national security, economic security, or public health and safety” and “the extent to which damage, disruption, or unauthorized access to such an entity . . . will likely enable the disruption of the reliable operation of critical infrastructure.” 6 U.S.C. 681a(a)(1); 6 U.S.C. 681b(c)(1)(A), 681b(c)(1)(C). Both CIRCIA's legislative history and statutory text highlight a number of more discrete purposes within the broader goals of enhancing national and economic security, and public health and safety. Some examples of these purposes include trend and threat analysis ( i.e., the performance of cybersecurity threat and incident trend analysis and tracking, to include the analysis and identification of adversary tactics, techniques, and procedures (TTPs)); 17 vulnerability and mitigation assessment ( i.e., the identification of cyber vulnerabilities and the assessment of countermeasures that might be available to address them); 18 the provision of early warnings ( i.e., the rapid sharing of information on cyber threats, vulnerabilities, and countermeasures through the issuance of cybersecurity alerts or other means); 19 incident response and mitigation ( i.e., rapid identification of significant cybersecurity incidents and offering of assistance— e.g., personnel, services—in incident response, mitigation, or recovery); 20 supporting Federal efforts to disrupt threat actors; 21 and advancing cyber resiliency ( i.e., developing and sharing strategies for improving overall cybersecurity resilience; facilitating use of cyber incident data to further cybersecurity research; engagement with software/equipment manufacturers on vulnerabilities and how to close them). 22 17 See, e.g., id. at 3; Stakeholder Perspectives on the Cyber Incident Reporting for Critical Infrastructure Act of 2021 Before the Subcomm. on Cybersecurity, Infrastructure Protection, and Innovation of the H. Comm. on Homeland Security, 117th Cong. 64 (2021), available at https://www.congress.gov/event/117th-congress/house-event/114018/text (hereinafter, “ Stakeholder Perspectives Hearing” ) (statement of Rep. Yvette Clarke) (“One of the goals in drafting this legislation was to provide CISA with enough information to analyze and understand threats . . . .”); 6 U.S.C. 681a(a)(1) (CISA must aggregate and analyze reports to identify TTPs adversaries use and to enhance situational awareness of cyber threats across critical infrastructure sectors). 18 See, e.g., Responding to and Learning from the Log4Shell Vulnerability Before the S. Comm. on Homeland Security and Governmental Affairs, 117th Cong. 2 (2022) (statement of Sen. Gary Peters, Chairman, S. Comm. on Homeland Security and Governmental Affairs), available at https://www.hsgac.senate.gov/hearings/responding-to-and-learning-from-the-log4shell-vulnerability/ (hereinafter, “ Log4Shell Vulnerability Hearing Peters Statement” ) (“This legislation will help our lead cybersecurity agency better understand the scope of attacks, including from vulnerabilities like Log4j. . . .”); 6 U.S.C. 681a(a)(1) (CISA must aggregate and analyze reports to assess the effectiveness of security controls). 19 See, e.g., Log4Shell Vulnerability Hearing Peters Statement, supra note 18, at 2 (“This legislation will help our lead cybersecurity agency . . . warn others of the threat, prepare for potential impacts. . . .”); Minority Staff of S. Comm. on Homeland Security and Governmental Affairs, 117th Cong., America's Data Held Hostage: Case Studies in Ransomware Attacks on American Companies vi (Comm. Print 2022), available at https://www.hsgac.senate.gov/library/files/americas-data-held-hostage-case-studies-in-ransomware-attacks-on-american-companies/ (“This legislation will enhance the Federal Government's ability to combat cyberattacks, mount a coordinated defense, hold perpetrators accountable, and prevent and mitigate future attacks through the sharing of timely and actionable threat information.”); 6 U.S.C. 681a(a)(3)(B) (CISA must provide entities with timely, actionable, and anonymized reports of cyber incident campaigns and trends, including, to the maximum extent practicable, cyber threat indicators and defensive measures); 6 U.S.C. 681a(a)(5)-(7) (CISA must identify and disseminate ways to prevent or mitigate cyber incidents, and must review reports for cyber threat indicators that can be anonymized and disseminated, with defensive measures, to stakeholders). 20 See, e.g., HSGAC Fact Sheet, supra note 2, at 1 (“This information will allow CISA to provide additional assistance to avoid cyber-attacks against our critical infrastructure, like the attacks on Colonial Pipeline and JBS Foods.”); Log4Shell Vulnerability Hearing Peters Statement, supra note 18 (“This legislation will help our lead cybersecurity agency . . . help affected entities respond and recover.”). 21 See, e.g., Press Release, S. Comm. on Homeland Security and Governmental Affairs, Portman, Peters Introduce Bipartisan Legislation Requiring Critical Infrastructure Entities to Report Cyberattacks (Sept. 28, 2021), available at https://www.hsgac.senate.gov/media/dems/peters-and-portman-introduce-bipartisan-legislation-requiring-critical-infrastructure-entities-to-report-cyber-attacks/ (“As cyber and ransomware attacks continue to increase, the federal government must be able to quickly coordinate a response and hold these bad actors accountable.”); Letter from Sen. Rob Portman, Ranking Member, S. Comm. on Homeland Security and Governmental Affairs, to Vanessa Countryman, Secretary, SEC, Re: RE: SEC Proposed Rule on Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure, File No. S7-09-22, 3 (May 9, 2022), available at https://www.sec.gov/comments/s7-09-22/s70922-20128391-291294.pdf (“When considering the legislation, Congress noted if the FBI is `provided information from reports under the process outlined in the statute, [it] may, as appropriate, use information contained in the reports and derived from them' for a range of investigatory activities. This is consistent with the statute which states incident reports can be used for `the purpose [of] preventing, investigating, disrupting, or prosecuting an offense arising out of a cyber incident' reported under the law. This allows law enforcement agencies to disrupt and deter hostile cyber actors. . . .” (footnotes omitted)). 22 See, e.g., 6 U.S.C. 681a(a)(9) (CISA must proactively identify opportunities to leverage and utilize data on cyber incidents to enable and strengthen cybersecurity research carried out by academia and private sector organizations). ii. How the Regulatory Purpose of CIRCIA Influenced the Design of the Proposed CIRCIA Regulation Based on CISA's understanding of the purposes of CIRCIA, CISA identified two fundamental principles that influenced the design of the proposed CIRCIA regulation in key areas. First, to achieve many of the desired goals of the proposed regulation—such as conducting analysis to identify adversary TTPs and providing early warnings to enhance situational awareness of cyber threats across critical infrastructure sectors—CISA needs to receive a sufficient quantity of Covered Cyber Incident Reports and Ransom Payment Reports from across the spectrum of critical infrastructure. As noted by the Cyberspace Solarium Commission, the government's cyber incident situational awareness, its ability to detect coordinated cyber campaigns, and its cyber risk identification and assessment efforts rely on comprehensive data and, prior to the passage of CIRCIA, the Federal government lacked a mandate to systematically collect cyber incident information reliably and at the scale necessary. 23 Sufficient data also is central to being able to differentiate campaigns from isolated incidents and support the development of more generalizable conclusions. 24 23 Cyberspace Solarium Commission, Cyberspace Solarium Commission Report at 103 (Mar. 2020), available at https://cybersolarium.org/march-2020-csc-report/march-2020-csc-report/ (hereinafter “ Cyberspace Solarium Commission Report” ); see also Sandra Schmitz-Berndt, “Defining the Reporting Threshold for a Cybersecurity Incident under the NIS Directive and the NIS 2 Directive,” Journal of Cybersecurity at 2 (Apr. 5, 2023) (“[L]ow reporting levels result in a flawed picture of the threat landscape, which in turn may impact cybersecurity preparedness.”), available at https://academic.oup.com/cybersecurity/article/9/1/tyad009/7160387. 24 See, e.g., CISA, Cost of a Cyber Incident: Systematic Review and Cross-Validation at 49 (Oct. 26, 2020) (reliance on limited data sources such as those based on convenience samples “means that no statistical representativeness can be claimed [which] limits the ability to support inference for generalizing results beyond the studied samples.”), available at https://www.cisa.gov/resources-tools/resources/cost-cyber-incident-systematic-review-and-cross-validation. If CISA designs the proposed regulations in a way that overly limits the quantity and variety of reports it receives from across critical infrastructure sectors, CISA will lack sufficient information to support reliable trend analysis, vulnerability identification, provision of early warnings, and other key purposes of the proposed regulation as indicated by CIRCIA. This fundamental principle was particularly important for CISA as it considered different options related to which entities should be required to report, what types of cyber incidents should be reported, and the scope and amount of technical detail necessary in CIRCIA Reports to enable CISA to conduct threat analysis, track campaigns, and provide early warnings as required by CIRCIA. Many stakeholders provided comments in response to the RFI issued in September 2022 cautioning CISA that collecting too many reports could result in data overload and hinder CISA's ability to identify important trends and vulnerabilities. While CISA agrees that there could be some point at which the number of reports submitted begins to yield diminishing marginal returns, CISA believes that, due to advances in technology and strategies for managing large data sets, the potential challenges associated with receiving large volumes of reports can be mitigated through technological and procedural strategies. Additionally, as discussed in Section IV.E.ii in this document, CISA proposes to design the reporting form in a manner that is easy for a covered entity or third-party submitter to complete, encourages the submission of useful information, and provides information to CISA in a manner that facilitates analysis and review. As a result, CISA is less concerned about receiving too many reports and more concerned about not receiving enough reports to support the intended regulatory purposes of the CIRCIA regulations. As noted by Microsoft President Brad Smith during his testimony in front of the U.S. Senate Select Committee on Intelligence during a hearing on the “Hack of U.S. Networks by a Foreign Adversary,” in the wake of the supply chain compromise of the SolarWinds Orion product, “one of the challenges in this space is the nature of all threat intelligence, whether it's cyber-based or physically based, is that it's always about connecting dots. So the more dots you have, the more likely you are to see a pattern and reach a conclusion. . . . And then they're spread out across different parts of the public sector as well. So this notion of aggregating them is key.” 25 25 Testimony of Brad Smith to the U.S. Senate Select Committee on Intelligence, “Hearing on Hack of U.S. Networks by a Foreign Adversary” (Feb. 23, 2021), available at https://www.intelligence.senate.gov/hearings/open-hearing-hearing-hack-us-networks-foreign-adversary. CISA is cognizant of the fact that reporting does not come without costs, however, so CISA is not seeking simply to capture the maximum number of reports possible under the statutory language ( i.e., by scoping both the applicability of the rule and covered cyber incidents as broadly as legally permissible). CISA's goal is to identify and achieve the proper balance among the number of reports being submitted, the benefits resulting from their submission, and the costs to both the reporting entities and the government of the submission, analysis, and storage of those reports. The second major principle CISA identified that influenced aspects of the proposed regulation was the importance of timeliness in both the receipt of reports and in CISA's ability to analyze and share information gleaned from those reports. To achieve the very important early visibility and warning aspects of this regulatory regime and increase the likelihood that entities across the critical infrastructure community will be able to address identified vulnerabilities and secure themselves against the latest adversary TTPs before falling victim to them, time is of the essence. CISA kept this second principle in mind as CISA considered options for when a covered entity's reporting obligations begin under the proposed regulation and the manner, form, and procedures for reporting. Similar to the first principle, CISA recognizes that potential drawbacks to overprioritizing timely reporting exist, such as potentially impacting a covered entity's ability to conduct preliminary incident response and mitigation. CISA also recognizes that a covered entity may not have all the information in the early aftermath of incident discovery, and that some preliminary determinations made at the outset of an incident response process may later be determined to be inaccurate when the entity is afforded time to conduct further investigation and analysis. Accordingly, CISA has sought to balance the critical need for timely reporting with the potential challenges associated with rapid reporting in the aftermath of a covered cyber incident. For example, CISA recognizes that covered entities may require some limited time to conduct preliminary analysis before establishing a reasonable belief that a covered cyber incident has occurred and thereby triggering the 72-hour timeframe for reporting. See Section IV.E.iv.1 in this document. Additionally, to the extent that information that is required to be reported under the regulation is evolving or unknown within the initial reporting deadline for a covered cyber incident, CISA is proposing to allow covered entities to submit new or updated information in a Supplemental Report as additional information becomes known about the covered cyber incident. See Section IV.E.iii.4 in this document. D. Harmonization Efforts Given the number of existing cyber incident reporting requirements at the Federal and SLTT levels, CISA recognizes that covered entities may be subject to multiple, potentially duplicative requirements to report cyber incidents. In an attempt to minimize the burden on covered entities potentially subject to both CIRCIA and other Federal cyber incident reporting requirements, CISA is committed to exploring ways to harmonize this regulation with other existing Federal reporting regimes, where practicable and seeks comment from the public on how it can further achieve this goal. CISA is already engaged in several efforts in furtherance of harmonization of cyber incident reporting, including: (1) serving as a member of the CIRC and participating in the CIRC's efforts to coordinate, deconflict, and harmonize Federal cyber incident reporting requirements; (2) participating in the Cybersecurity Forum for Independent and Executive Branch Regulators; (3) performing extensive outreach with Federal and non-Federal entities to gain a fulsome understanding of the existing cyber incident reporting regulatory landscape and gather perspectives on how to harmonize existing cyber incident reporting requirements; and (4) engaging with other Federal departments and agencies that implement cyber incident reporting requirements to determine whether covered entities could potentially take advantage of the proposed substantially similar reporting exception to CIRCIA reporting (discussed further in Section IV.D.i in this document). CISA actively participated in the CIRC to help identify potential approaches to harmonizing Federal cyber incident reporting requirements and to support the identification of recommended practices that could be considered by CISA and other Federal departments and agencies as they develop or update their respective cyber incident reporting regimes. Specifically, CISA participated in various DHS-led working groups to identify potential recommended practices and areas of harmonization related to Federal cyber incident reporting requirements, many of which are reflected in the DHS Report. 26 CISA considered the DHS Report and its recommendations as it developed this proposed rule and attempted to leverage the model definition and reporting form recommended in the DHS Report to the extent practicable and consistent with the unique regulatory authority granted to CISA under CIRCIA and the purpose of the CIRCIA regulation (described in Sections III.A and C in this document). 26 DHS Report, supra note 4, at 5. CISA has also been an active participant in the Cybersecurity Forum for Independent and Executive Branch Regulators. The goal of this forum, which was initially launched in 2014, is to increase the overall effectiveness and consistency of Federal regulatory authorities related to cybersecurity by enhancing communication among regulatory agencies, sharing best practices, and exploring ways to align, leverage, and deconflict approaches to cybersecurity regulation. 27 Current participants in the Forum include, among others, FCC, CISA, CFTC, Consumer Product Safety Commission, Department of Health and Human Services (HHS), DHS, Department of the Treasury, FERC, FHFA, FRB, Federal Trade Commission, FDA, NRC, OCC, SEC, TSA, USCG, and the Office of the National Cyber Director. 27 See Cybersecurity Forum for Independent and Executive Branch Regulators Charter (2014), available at https://www.nrc.gov/docs/ML1501/ML15014A296.pdf. Additionally, CISA has performed, and as required by CIRCIA, plans on continuing to perform, outreach to both Federal partners and non-Federal stakeholders to learn about existing and proposed cyber incident reporting regulations and ways in which CISA may be able to design and implement the CIRCIA requirements to harmonize with those reporting requirements to the extent practicable. In addition to the RFI and listening sessions described in Section III.F in this document, CISA held a series of consultations with each Sector Risk Management Agency (SRMA), all Federal departments and agencies that currently oversee cyber incident reporting requirements, and various other Federal departments and agencies with equities in cyber incident and ransom payment reporting. During these engagements, CISA has sought to learn about existing and proposed Federal regimes that require the reporting of cyber incidents or ransom payments and discuss areas where CISA and its Federal counterparts might want to, and be able to, harmonize their respective reporting requirements. CISA leveraged the information gained via the RFI, listening sessions, and Federal consultations in the development of this NPRM, and intends to continue to engage Federal partners during the development and implementation of the final rule in an attempt to harmonize reporting requirements and reduce the burden on potential covered entities, where practicable. Finally, CISA intends to work with other Federal departments and agencies to explore opportunities to reduce duplicative reporting of covered cyber incidents through a proposed substantially similar reporting exception to CIRCIA. Under this exception, which is authorized under 6 U.S.C. 681b(a)(5)(B), a covered entity that is required by law, regulation, or contract to report information to another Federal entity that is substantially similar to the information that must be reported under CIRCIA and is required to submit the report in a substantially similar timeframe to CIRCIA's reporting deadlines, may be excepted from reporting it again under CIRCIA. Per the statute, for covered entities to be able to leverage this specific exception, CISA and the respective Federal entity must enter into an interagency agreement, referred to as a CIRCIA Agreement, and establish an information sharing mechanism to share reports. To the extent practicable, CISA is committed to working in good faith with its Federal partners to have CIRCIA Agreements finalized before the effective date of the final rule. Additional details on the substantially similar reporting exception to CIRCIA are discussed in Section IV.D.i in this document. CISA welcomes all comments on all aspects of harmonizing CIRCIA's regulatory reporting requirements with other cyber incident and ransom payment reporting requirements, including: 1. Potential approaches to harmonizing CIRCIA's regulatory reporting requirements with other existing Federal or SLTT laws, regulations, directives, or similar policies that require reporting of cyber incidents or ransom payments. 2. How to reduce actual, likely, or potential duplication or conflict between other Federal or SLTT laws, regulations, directives, or policies and CIRCIA's reporting requirements. E. Information Sharing Required by CIRCIA Sharing information on cyber incidents, ransomware attacks, and the broader cyber threat landscape is central to CIRCIA. In fact, CIRCIA imposes several requirements upon CISA and other Federal departments and agencies related to the sharing of information received through cyber incident and ransom payment reporting programs, including the CIRCIA proposed regulations. As Congress imposed these obligations solely on Federal departments and agencies, they are not included in the CIRCIA proposed rule; however, information sharing will be an integral part of the overall CIRCIA implementation, and CISA is committed to working with its Federal partners to share cyber threat information across the Federal government and, as appropriate, with non-Federal stakeholders. As required by 6 U.S.C. 681a(a)(10) and (b), CISA will make information received via CIRCIA Reports or in response to an RFI or subpoena available to appropriate SRMAs and other appropriate Federal departments and agencies, as determined by the President or a designee of the President, within 24 hours of receipt. CIRCIA also includes a reciprocal requirement, where any Federal department or agency that receives a report of a cyber incident shall provide the report to CISA within 24 hours of receiving the report. See 6 U.S.C. 681g(a)(1). Upon receipt of a report from another Federal agency pursuant to this requirement, CISA must share the report with other Federal agencies as it would any other report submitted to CISA under CIRCIA. 6 U.S.C. 681a(a)(10), 681a(b), 681g(a)(1). In addition to any otherwise generally applicable laws (such as the Privacy Act of 1974 28 and the E-Government Act of 2002 29 ), pursuant to 6 U.S.C. 681g(a)(3), CISA must protect the reports it receives from Federal partners under these provisions in accordance with any privacy, confidentiality, or information security requirements imposed upon the originating Federal department or agency. CIRCIA also requires CISA to “coordinate and share information with appropriate Federal departments and agencies to identify and track ransom payments.” 6 U.S.C. 681a(a)(2). 28 See 5 U.S.C. 552a. 29 See 44 U.S.C. 3501 note, Public Law 107-347. CIRCIA imposes requirements on CISA related to sharing cyber threat information with non-Federal stakeholders as well. For example, 6 U.S.C. 681a(a)(7) requires CISA to immediately review Covered Cyber Incident Reports or voluntary reports submitted to CISA pursuant to 6 U.S.C. 681c to the extent they involve ongoing cyber threats or security vulnerabilities for cyber threat indicators that can be anonymized and disseminated, with defensive measures, to appropriate stakeholders. Similarly, for a covered cyber incident or group of covered cyber incidents that satisfies the definition of a significant cyber incident, CISA must conduct a review of the details surrounding the incident(s) and identify and disseminate ways to prevent or mitigate similar incidents in the future. 6 U.S.C. 681a(a)(6). CISA must also “publish quarterly unclassified, public reports that describe aggregated, anonymized observations, findings, and recommendations” based on Covered Cyber Incident Reports. 6 U.S.C. 681a(a)(8). In addition to limiting sharing of information as may otherwise be required by laws that are generally applicable to information received by the Federal government, such as the Trade Secrets Act, 30 when sharing with critical infrastructure owners and operators and the general public any information received via CIRCIA Reports or responses to RFIs, CISA must anonymize information related to the victim who reported the incident. See 6 U.S.C. 681e(d). 30 18 U.S.C. 1905. F. Summary of Stakeholder Comments While developing this NPRM, CISA sought feedback from an array of public and private sector stakeholders in an effort to identify the most effective potential approach to implementing CIRCIA's reporting requirements. CISA published an RFI in the Federal Register ; 31 held in-person, public listening sessions around the country; 32 conducted virtual, sector-specific listening sessions; 33 and consulted with SRMAs and other relevant Federal departments and agencies, all with the goal of receiving meaningful input from entities that will potentially be impacted by this regulation. CISA has considered this feedback when developing the proposals set forth in this NPRM. A summary of the most salient points received in response to the RFI and during the CIRCIA listening sessions follows. All comments received in response to the RFI, as well as transcripts from all the public and sector-specific listening sessions, are available in the electronic docket for this rulemaking. 31 The RFI, which was published in the Federal Register on September 12, 2022, solicited inputs on potential aspects of the proposed regulation prior to the publication of this NPRM. CISA did not limit the type of feedback commenters could submit in response to the RFI, but did specifically request comments on definitions for and interpretations of the terminology to be used in the proposed regulation; the form, manner, content, and procedures for submission of reports required under CIRCIA; information regarding other incident reporting requirements including the requirement to report a description of the vulnerabilities exploited; and other policies and procedures, such as enforcement procedures and information protection policies, that will be required for implementation of the regulation. The comment period was open through November 14, 2022, and CISA received 131 individual comments in response to the RFI. 87 FR 55833. 32 Between September 21, 2022, and November 16, 2022, CISA hosted ten listening sessions in Salt Lake City, Utah; Chicago, Illinois; Fort Worth, Texas; New York, New York; Philadelphia, Pennsylvania; Washington, DC; Oakland, California; Boston, Massachusetts; Seattle, Washington; and Kansas City, Missouri. 87 FR 55830; 87 FR 60409. 33 Because CIRCIA defines covered entities with reference to critical infrastructure sectors, CISA held sector-specific listening sessions for each of the 16 critical infrastructure sectors identified in Presidential Policy Directive 21, see https://www.cisa.gov/topics/critical-infrastructure-security-and-resilience/critical-infrastructure-sectors, as well as a separate session for the Aviation Subsector. Transcripts from these sessions can be viewed in the docket for this rulemaking by going to www.regulations.gov and searching for CISA-2022-0010. i. General Comments In general, several commenters told CISA that the regulations should be easy to comply with, such that individuals who are not cybersecurity professionals can complete the required reporting, and avoid overly burdensome requirements. 34 Commenters recommended that compliance with the regulation be incentive-based and supportive, rather than punitive, 35 and commenters also expressed concerns about the confidentiality of reported information. 36 Commenters also urged CISA to consider the landscape of existing cyber incident reporting requirements and expressed general concern about the potential negative impacts of unharmonized, complex, and duplicative reporting regimes. 37 34 See, e.g., Comments submitted by the Confidentiality Coalition, CISA-2022-0010-0030; Credit Union National Association, CISA-2022-0010-0050; SAP, CISA-2022-0010-0114; Federation of American Hospitals, CISA-2022-0010-0063; Epic, CISA-2022-0010-0090. 35 See, e.g., Comments submitted by the Arizona Cyber Threat Response Alliance and Arizona Technical Council, CISA-2022-0010-0022; SolarWinds, CISA-2022-0010-0027. 36 See, e.g., Comments submitted by Google Cloud, CISA-2022-0010-0109; Tenable, CISA-2022-0010-0032; NCTA—The Internet & Television Association, CISA-2022-0010-0102. 37 See, e.g., Comments submitted by CTIA, CISA-2022-0010-0070; R Street Institute, CISA-2022-0010-0125; IBM, CISA-2022-0010-0069; Cybersecurity Coalition, CISA-2022-0010-0105. ii. Comments on the Definition of Covered Entity Several commenters provided suggestions on how to define the term covered entity under this regulation. While some commenters thought the definition of covered entity was straightforward and already understood, 38 others pointed to different criteria or frameworks CISA could use to scope the definition more effectively. These included, among others, a size-based threshold, 39 a risk-based approach, 40 or a focus on the degree to which an entity supported a NCF. 41 Commenters also suggested leveraging existing lists, standards, or definitions, such as the list of critical infrastructure “where a cybersecurity incident could reasonably result in catastrophic regional or national effects on public health or safety, economic security, or national security,” as determined pursuant to Section 9(a) of Executive Order 13636; 42 the NERC CIP standard; 43 the National Institute of Standards and Technology's (NIST's) definition; 44 or definitions used by other countries. 45 Others suggested considering the unique qualities of particular industries and sectors and either creating sector-based definitions or excluding certain sectors and industries from the definition altogether. 46 38 See, e.g., Comment submitted by the Arizona Cyber Threat Response Alliance and Arizona Technical Council, CISA-2022-0010-0022. 39 See, e.g., Comments submitted by the Computing Technology Industry Association, CISA-2022-0010-0122; BlackBerry Corporation, CISA-2022-0010-0036; Cyber Threat Alliance, CISA-2022-0010-0019; SolarWinds, CISA-2022-0010-0027. 40 See, e.g., Comments submitted by the Information Technology Industry Council, CISA-2022-0010-0097; U.S. Chamber of Commerce, CISA-2022-0010-0075; American Property Casualty Insurance Association, CISA-2022-0010-0064. 41 See, e.g., Comment submitted by Mitchell Berger, CISA-2022-0010-0004 . 42 See, e.g., Comments submitted by the UnityPoint Health, CISA-2022-0010-0107; National Retail Federation, CISA-2022-0010-0092; National Rural Electric Cooperative Association, CISA-2022-0010-0025. 43 See, e.g., Comment submitted by the Powder River Energy Corporation, CISA-2022-0010-0099. 44 See, e.g., Comment submitted by the Credit Union National Association, CISA-2022-0010-0050. 45 See, e.g., Comment submitted by SAP, CISA-2022-0010-0114. 46 See, e.g., Comments submitted by the Rural Wireless Association, Inc., CISA-2022-0010-0093 (recommending excluding small telecommunications carriers); TechNet, CISA-2022-0010-0072 (discussing the “innovation economy”); American Property Casualty Insurance Association, CISA-2022-0010-0064 (recommending exclusion of insurance agencies); NAFCU, CISA-2022-0010-0076 (recommending exclusion of the credit union industry). iii. Comments on the Definition of Covered Cyber Incident and Substantial Cyber Incident Many commenters provided thoughts on how to define covered cyber incident and substantial cyber incident, including some who offered their own definitions for CISA to consider. 47 Multiple commenters indicated a desire for a high threshold for reporting to minimize burdens on regulated entities, avoid duplicative reporting, and prevent CISA from being inundated with reports, 48 although at least one commenter noted that a narrow definition could leave CISA with an incomplete understanding of the threat landscape. 49 In recommending high thresholds, commenters suggested that CISA could bound the definition of covered cyber incident in a variety of ways, such as by limiting reporting to “confirmed incidents”; 50 incidents that cause “actual harm”; 51 only incidents that impact business operations; 52 only incidents that impact an entity's critical infrastructure functions; 53 incidents that directly impact U.S. companies, citizens, economies or national security; 54 and/or those resulting only from malicious intent. 55 Several commenters also advocated for considering definitions that already exist, such as the definition created by NIST that is used in FISMA, 56 or definitions that are already used among the 16 critical infrastructure sectors. 57 47 See, e.g., Comments submitted by the Cybersecurity Coalition, CISA-2022-0010-0105; Microsoft Corporation, CISA-2022-0010-0058. 48 See, e.g., Comments submitted by The Associations: BPI, ABA, IIB, SIFMA, CISA-2022-0010-0046; American Council of Life Insurers, CISA-2022-0010-0095; UnityPoint Health, CISA-2022-0010-0107; Cloudflare, Inc., CISA-2022-0010-0074; American Property Casualty Insurance Association, CISA-2022-0010-0064; Jim Wollbrinck, CISA-2022-0010-0151. 49 See, e.g., Comment submitted by NERC, CISA-2022-0010-0049. 50 See, e.g., Comments submitted by Mandiant, CISA-2022-0010-0120; Edison Electric Institute, CISA-2022-0010-0079; Connected Health Initiative, CISA-2022-0010-0130; ACT | The App Association, CISA-2022-0010-0129. 51 See, e.g., Comments submitted by the internet Infrastructure Coalition, CISA-2022-0010-0055; Independent Community Bankers of America, CISA-2022-0010-0080; Institute of International Finance, CISA-2022-0010-0060. 52 See, e.g., Comments submitted by IBM, CISA-2022-0010-0069; Edison Electric Institute, CISA- 2022-0010-0079; Fidelity National Information Services, CISA-2022-0010-0033; National Technology Security Coalition, CISA-2022-0010-0061. 53 See, e.g., Comments submitted by IBM, CISA-2022-0010-0069; CrowdStrike, CISA-2022-0010-0128; Microsoft Corporation, CISA-2022-0010-0058; Professional Services Council, CISA-2022-0010-0044; Alliance for Automotive Innovation (Auto Innovators), CISA-2022-0010-0082; Telecommunications Industry Association, CISA-2022-0010-0132. 54 See, e.g., Comments submitted by Airlines for America, CISA-2022-0010-0066; U.S. Chamber of Commerce, CISA-2022-0010-0075; Express Association of America, CISA-2022-0010-0038; The Associations: AFPM, AGA, API, APGA, INGAA, LEPA, CISA-2022-0010-0057. 55 See, e.g., Comments submitted by Cloudflare, Inc., CISA-2022-0010-0074; The Associations: BPI, ABA, IIB, SIFMA, CISA-2022-0010-0046; internet Infrastructure Coalition, CISA-2022-0010-0055. 56 See, e.g., Comments submitted by the National Technology Security Coalition, CISA-2022-0010-0061; The Associations: BPI, ABA, IIB, SIFMA, CISA-2022-0010-0046; Mandiant, CISA-2022-0010-0120; Glenn Herdrich, CISA-2022-0010-0158. 57 See, e.g., Comments submitted by NCTA—The Internet & Television Association, CISA-2022-0010-0102 (generally advocating for a sector-based approach to the definition); Financial Services Sector Coordinating Council, CISA-2022-0010-0094; The Associations: BPI, ABA, IIB, SIFMA, CISA-2022-0010-0046; The Clearing House, CISA-2022-0010-0086 (advocating for alignment with the FDIC's Computer-Security Incident Notification Rule); HIMSS Electronic Health Record Association, CISA-2022-0010-0040 (advocating for alignment with the Health Insurance Portability and Accountability Act requirements); Nuclear Energy Institute, CISA-2022-0010-0029; Rich Mogavero, CISA-2022-0010-0139 (advocating alignment with the definition used by the NRC); Electric Power Supply Association, CISA-2022-0010-0045; Edison Electric Institute, CISA-2022-0010-0079 (advocating for alignment with the reporting standards used by the NERC); NTCA—The Rural Broadband Association, CISA-2022-0010-0100 (recommending consideration of the FCC's reporting requirements in developing the definition). Comments received on the potential definition of substantial cyber incident echoed those received on the potential definition of covered cyber incident, though a few commenters noted that the term substantial cyber incident does not have existing legal definitions as does covered cyber incident. 58 One commenter noted that CISA should clarify whether “substantial cyber incidents” are separate from “covered cyber incidents,” 59 and another commenter recommended covered cyber incidents and substantial cyber incidents should be synonymous terms. 60 58 See, e.g., Comments submitted by the Association of Metropolitan Water Agencies, CISA-2022-0010-0088; U.S. Chamber of Commerce, CISA-2022-0010-0075; Fidelity National Information Services, CISA-2022-0010-0033. 59 See, e.g., Comment submitted by the Professional Services Council, CISA-2022-0010-0044. 60 See, e.g., Comment submitted by Gideon Rasmussen, CISA-2022-0010-0011. iv. Comments on Other Definitions CISA received a small number of comments on other definitions. A few commenters provided feedback on the meaning of the terms ransom payment and ransomware attack, with several noting that the definitions of ransom payment and ransomware attack were understood as defined in CIRCIA and recommending no changes to these terms in the regulation. 61 61 See, e.g., Comments submitted by (ISC)2, CISA-2022-0010-0112; Exelon Corp., CISA-2022-0010-0043; SAP, CISA-2022-0010-0114. A few commenters offered input on the meaning of supply chain compromise, with those who did often acknowledging the statutory definition of the term (see 6 U.S.C. 650(28)), 62 and recommending that CISA align this term as closely as possible with similar, existing terms, such as “supply chain attack” used by NIST or the definition of “supply chain compromise” used by MITRE. 63 Several commenters emphasized a need for clarity regarding when a customer or end user would be expected to report on an incident caused somewhere above them in the supply chain, noting that in many cases the impacted covered entity may have limited visibility into what happened along the supply chain to cause the incident. 64 62 See, e.g., Comment submitted by the Cybersecurity Coalition, CISA-2022-0010-0105. 63 See id.; see, e.g., Comment submitted by the Information Technology Industry Council, CISA-2022-0010-0097. 64 See, e.g., Comments submitted by the American Water Works Association, CISA-2022-0010-0127; Edison Electric Institute, CISA-2022-0010-0079; NCTA—The Internet & Television Association, CISA-2022-0010-0102; Exelon Corp., CISA-2022-0010-0043. v. Comments on Criteria for Determining Whether the Domain Name System Exception Applies The few comments received relating to whether an entity is a multi-stakeholder organization that develops, implements, and enforces policies concerning the DNS reflected different views. One commenter recommended that CISA clarify that domain name registries and registrars are “governed by a multistakeholder organization.” 65 Another commenter opined that it would not be appropriate to exempt domain name registrars. The same commenter recommended that CISA identify exempted organizations by name in the final rule, listing Internet Corporation for Assigned Names and Numbers (ICANN) and the Regional Internet Registries for consideration. 66 65 Comment submitted by the Internet Infrastructure Coalition, CISA-2022-0010-0055. 66 See Comment submitted by the Energy Transfer LP, CISA-2022-0010-0037. Regional Internet Registries include ARIN, LACNIC, RIPE NCC, AFRINIC, and APNIC (see Regional Internet Registries | The Number Resource Organization ( nro.net )). vi. Comments on Manner and Form of Reporting, Content of Reports, and Reporting Procedures Numerous commenters provided recommendations on the manner and form of reporting, with many of those concurring with the use of a web-based form for reporting or other means of electronic reporting. 67 Some explicitly recommended that CISA make a mobile application or otherwise make the form available via a mobile device as well. 68 Several commenters recommended alternative or additional methods of reporting to include phone or email. 69 Multiple commenters emphasized that reporting should not require the download or purchase of new technology. 70 A number of commenters recommended that the same portal be used for Supplemental Reports as for the original reports. 71 67 See, e.g., Comments submitted by American Council of Life Insurers, CISA-2022-0010-0095; HIMSS Electronic Health Record Association, CISA-2022-0010-0040; Epic, CISA-2022-0010-0090; Cyber Threat Alliance, CISA-2022-0010-0019; League of Southeastern Credit Unions, CISA-2022-0010-0121; Marty Reynolds, CISA-2022-0010-0135; Patrick Thornton, CISA-2022-0010-0144. 68 See, e.g., Comments submitted by the Cyber Threat Alliance, CISA-2022-0010-0019; Workgroup for Electronic Data Interchange, CISA-2022-0010-0041; OCHIN, CISA-2022-0010-0039; Cybersecurity Coalition, CISA-2022-0010-0105. 69 See, e.g., Comments submitted by CHIME, CISA-2022-0010-0035; Business Roundtable, CISA-2022-0010-0115; CTIA, CISA-2022-0010-0070; The Clearing House, CISA-2022-0010-0086. 70 See, e.g., Comments submitted by the Operational Technology Cybersecurity Coalition, CISA-2022-0010-0108; NTCA—The Rural Broadband Association, CISA-2022-0010-0100; Tenable, CISA-2022-0010-0032. 71 See, e.g., Comments submitted by the Cybersecurity Coalition, CISA-2022-0010-0105; Information Technology Industry Council, CISA-2022-0010-0097; Credit Union National Association, CISA-2022-0010-0050. Overall, commenters emphasized the need for a user-friendly reporting form. While several commenters recommended that the reporting form be standardized for all covered entities, 72 at least one commenter noted that a uniform reporting format could unintentionally limit the type of information CISA receives. 73 Many commenters recommended that any reporting form include drop-down menus, check-boxes, or other fields that could be pre-populated for ease of submission. 74 Other commenters recommended that the incident reporting form generate questions pertinent to the type of incident being reported, including an indication of which fields were required for each type of report. 75 Several commenters also recommended that CISA assign reference numbers to each report, which would allow entities to more easily locate and return to a specific CIRCIA Incident Reporting Form at a later point. 76 Commenters also recommended existing reporting or submission procedures that CISA could emulate. Some commenters recommended CISA rely on a standardized approach, noting examples such as the National Information Exchange Model 77 or Structured Threat Information eXpression (STIX) and Trusted Automated Exchange of Intelligence Information (TAXII). 78 Other commenters recommended CISA align its reporting approach to that of other Federal departments and agencies such as USCG, 79 TSA, 80 or DOD. 81 72 See, e.g., Comments submitted by the Alliance for Automotive Innovation, CISA-2022-0010-0082; Lucid Motors, CISA-2022-0010-0078; USTelecom—The Broadband Association, CISA-2022-0010-0067; Palo Alto Networks, CISA-2022-0010-0089. 73 See, e.g., Comment submitted by the Association of American Railroads, CISA-2022-0010-0117. 74 See, e.g., Comments submitted by the Workgroup for Electronic Data Interchange, CISA-2022-0010-0041; CTIA, CISA-2022-0010-0070; Anonymous, CISA-2022-0010-0012; National Grain and Feed Association, CISA-2022-0010-0104; Mitchell Berger, CISA-2022-0010-0004; League of Southeastern Credit Unions, CISA-2022-0010-0121; NERC, CISA-2022-0010-0049. 75 See, e.g., Comments submitted by the Municipal Information Systems Association of California, CISA-2022-0010-0118; City of Roseville, CISA-2022-0010-0111; City of Cerritos, CISA-2022-0010-0084; Cyber Threat Alliance, CISA-2022-0010-0019; (ISC)2, CISA-2022-0010-0112. 76 See, e.g., Comments submitted by the Arizona Cyber Threat Response Alliance and Arizona Technical Council, CISA-2022-0010-0022; Workgroup for Electronic Data Interchange, CISA-2022-0010-0041. 77 See, e.g., Comments submitted by the Cyber Threat Alliance, CISA-2022-0010-0019; SolarWinds, CISA-2022-0010-0027; MITRE, CISA-2022-0010-0073. 78 See, e.g., Comments submitted by ACT | The App Association, CISA-2022-0010-0129; Connected Health Initiative, CISA-2022-0010-0130; Cyber Threat Alliance, CISA-2022-0010-0019; HIMSS, CISA-2022-0010-0119. 79 See, e.g., Comment submitted by the American Association of Port Authorities, CISA-2022-0010-0126. 80 See, e.g., Comment submitted by Energy Transfer LP, CISA-2022-0010-0037. 81 See, e.g., Comment submitted by Trustwave Government Solutions, CISA-2022-0010-0096. When proposing suggestions for the content of CIRCIA reports, many commenters recommended that CISA require minimal detail at the 72-hour reporting deadline to not divert resources from response efforts, 82 emphasizing that covered entities should be required to report only what is absolutely needed. 83 Several commenters recommended a core set of questions be asked for every covered entity, 84 while others suggested the question set could be sector-specific. 85 Many commenters offered their thoughts on specific pieces of data that CISA should consider collecting via the CIRCIA reporting form, many, if not most, of which covered entities are statutorily required to include in either Covered Cyber Incident Reports or Ransom Payment Reports. 86 Some non-statutorily required fields that commenters suggested included: identification of critical infrastructure sector, anyone else that the entity informed, severity of the event, and victim IP addresses. 87 82 See, e.g., Comments submitted by BSA | The Software Alliance, CISA-2022-0010-0106; SAP, CISA-2022-0010-0114; Arizona Cyber Threat Response Alliance and Arizona Technical Council, CISA-2022-0010-0022; American Chemistry Council, CISA-2022-0010-0098; U.S. Chamber of Commerce, CISA-2022-0010-0075. 83 See, e.g., Comments submitted by CHIME, CISA-2022-0010-0035; Google Cloud, CISA-2022-0010-0109; The Clearing House, CISA-2022-0010-0086; Information Technology-ISAC, CISA-2022-0010-0048. 84 See, e.g., Comments submitted by the Institute of International Finance, CISA-2022-0010-0060; National Association of Chemical Distributors, CISA-2022-0010-0056; UnityPoint Health, CISA-2022-0010-0107; Powder River Energy Corporation, CISA-2022-0010-0099. 85 See, e.g., Comments submitted by HIMSS, CISA-2022-0010-0109; CHIME, CISA-2022-0010-0035; CTIA, CISA-2022-0010-0070. 86 See, e.g., Comments submitted by the U.S. Chamber of Commerce, CISA-2022-0010-0075 (recommending that CISA focus on the ten elements listed in CISA's Sharing Cyber Event Information: Observe, Act, Report document, namely: incident date and time, incident location, type of observed activity; detailed narrative of the event; number of people or systems affected; company/organization name; point of contact details; severity of event; critical infrastructure sector; and anyone else the entity informed.); Cyber Threat Alliance, CISA-2022-0010-0019 (recommending that the form include three “layers,” containing fields applicable to all incidents (victim information, incident type, incident information, and threat actor information), incident specific fields (with different fields each for business email compromise, ransomware or other extortion, data theft, financial theft such as banking trojans, service theft, denial of service, disruptive or destructive attack, data manipulation or integrity loss, branding/reputation attack, or unauthorized access), and an optional layer for the provision of technical information (such as victim IP addresses, threat actor groups, MITRE ATT&CK mapping, exploited vulnerabilities)); Municipal Information Systems Association of California, CISA-2022-0010-0118 (recommending that the form include impacted “[a]gency,” date of incident, date incident discovered, indicators of compromise, type of data compromised (if applicable), other compliance agencies mandated to receive this report, a description of the incident, steps taken so far, and logs); City of Roseville, CISA-2022-0010-0111 (same); City of Cerritos, CISA-2022-0010-0084 (same); Palo Alto Networks, CISA-2022-0010-0089 (recommending that the template reporting form include the attack vector or vectors that led to the compromise; tactics or techniques used by threat actor; indicators of compromise; information on the affected systems, devices, or networks; information relevant to the identification of the threat actor or actors involved; a point of contact from the affected entity; and impact, earliest known time, and duration of compromise); Mitchell Berger, CISA-2022-0010-0004 (suggesting that CISA include a list of the 16 critical infrastructure sectors, 55 national critical functions, or similar items with boxes to check). 87 See id. vii. Comments on the Deadlines for Submission of CIRCIA Reports Although the 72-hour reporting deadline for the reporting of a covered cyber incident is codified in the text of CIRCIA itself, several commenters offered thoughts on how to interpret this requirement. Many commenters suggested that CISA provide flexibility in initiating the 72-hour clock due to the challenges entities face in identifying a “reasonable belief” and responding to covered cyber incidents. 88 Similarly, commenters urged that CISA adopt certain flexibilities in considering the deadline to have been met, such as allowing entities to omit fields on a form when information is not yet known 89 or provide extensions to the 72-hour deadline when covered entities are experiencing an external event, such as a natural disaster or pandemic. 90 A few commenters noted that it may not be objective or clear in the moment when a covered entity has a “reasonable belief,” and recommended that CISA consider determining whether a reasonable belief exists on a case-by-case basis. 91 Many commenters stated that “reasonable belief” should be defined as a confirmed or validated cyber incident from the perspective of the covered entity and that the 72-hour clock should therefore begin at that time. 92 88 See, e.g., Comments submitted by Cybersecurity Coalition, CISA-2022-0010-0105; TechNet, CISA-2022-0010-0072; Federation of American Hospitals, CISA-2022-0010-0063; National Association of Manufacturers, CISA-2022-0010-0087; American Council of Life Insurers, CISA-2022-0010-0095. 89 See, e.g., Comment submitted by Google Cloud, CISA-2022-0010-0109. 90 See, e.g., Comment submitted by HIMSS, CISA-2022-0010-0119. 91 See, e.g., Comments submitted by NCTA—The Internet & Television Association, CISA-2022-0010-0102; SAP, CISA-2022-0010-0114; CTIA, CISA-2022-0010-0070. 92 See, e.g., Comments submitted by National Electrical Manufacturers Association, CISA-2022-0010-0026; League of Southeastern Credit Unions, CISA-2022-0010-0121; The Associations: AFPM, AGA, API, APGA, INGAA, LEPA, CISA-2022-0010-0057; Trustwave Government Solutions, CISA-2022-0010-0096; Microsoft Corporation, CISA-2022-0010-0058. Similarly, several commenters recommended specific interpretations for the point at which the 24-hour clock deadline for submission of a Ransom Payment Report should begin. For instance, commenters recommended that the 24-hour clock should begin after the ransom payment is sent, 93 when “funds or items of value are transmitted to the extorting party,” 94 or as soon as “any part” of the ransom payment is no longer in possession of the impacted entity or any of its affiliated third parties. 95 93 See, e.g., Comments submitted by Exelon Corp., CISA-2022-0010-0043; Cybersecurity Coalition, CISA-2022-0010-0105; Credit Union National Association, CISA-2022-0010-0050; National Association of Chemical Distributors, CISA-2022-0010-0056. 94 See, e.g., Comment submitted by the Cybersecurity Coalition, CISA-2022-0010-0105. 95 See, e.g., Comment submitted by Sophos, Inc, CISA-2022-0010-0047. In regards to Supplemental Reports, while some commenters recommended flexibility, including no deadline for timing of submission of Supplemental Reports, 96 others recommended CISA provide a separate deadline for the submission of Supplemental Reports. 97 Recommended deadlines varied from as short as 12 hours after discovering substantially new or different information 98 to as long as one year after the incident. 99 On the question of what should constitute substantially new or different information that would necessitate filing a Supplemental Report, many commenters recommended that covered entities be permitted to decide when new findings necessitate a Supplemental Report. 100 Other commenters suggested the types of material changes that could be considered substantial new or different information, such as changes to the types of data stolen or altered; changes to the number or type of systems impacted; or updates to information regarding the TTPs used in the incident. 101 96 See, e.g., Comments submitted by the Airlines for America, CISA-2022-0010-0066; SAP, CISA-2022-0010-0114. 97 See, e.g., Comments submitted by SolarWinds, CISA-2022-0010-0027; Workgroup for Electronic Data Interchange, CISA-2022-0010-0041; Telecommunications Industry Association, CISA-2022-0010-0132. 98 See, e.g., Comment submitted by Sophos, Inc, CISA-2022-0010-0047. 99 See, e.g., Comment submitted by the Workgroup for Electronic Data Interchange, CISA-2022-0010-0041. 100 See, e.g., Comments submitted by USTelecom—The Broadband Association, CISA-2022-0010-0067; Institute of International Finance, CISA-2022-0010-0060; Exelon Corp., CISA-2022-0010-0043. 101 See, e.g., Comments submitted by the Institute of International Finance, CISA-2022-0010-0060; League of Southeastern Credit Unions, CISA-2022-0010-0121; Payments Leadership Council, CISA-2022-0010-0031. viii. Comments on Third-Party Submitters Of the commenters who offered feedback on the third-party submissions of CIRCIA Reports, most seemed to support the framework already contemplated by statute. For instance, one commenter stated that organizations should be able to identify a third party to submit on their behalf, 102 and more than one stated that the reporting mechanisms, guidelines, and procedures should be the same for the third-party submitter as for the covered entity. 103 Many commenters recommend that CISA clarify that the duty to comply with the regulation falls on the covered entity, 104 and that third-party submitters have no obligation to report on the covered entity's behalf. 105 102 See, e.g., Comment submitted by American Chemistry Council, CISA-2022-0010-0098. 103 See, e.g., Comments submitted by American Chemistry Council, CISA-2022-0010-0098; CrowdStrike, CISA-2022-0010-0128. 104 See, e.g., Comments submitted by BlackBerry; CISA-2022-0010-0036; American Property Casualty Insurance Association, CISA-2022-0010-0064; Computing Technology Industry Association, CISA-2022-0010-0122. 105 See, e.g., Comments submitted by the Cyber Threat Alliance, CISA-2022-0010-0019; Airlines for America, CISA-2022-0010-0066; Operational Technology Cybersecurity Coalition, CISA-2022-0010-0108; Information Technology-ISAC, CISA-2022-0010-0048; BlackBerry, CISA-2022-0010-0036. Some commenters recommended additional safeguards for covered entities using third-party reporters. A few commenters recommended that CISA clarify the types of third parties authorized to submit reports on behalf of the covered entity. 106 One commenter recommended that CISA consider entities like ISACs to be suitable third-party reporters. 107 Multiple commenters also recommended that CISA allow third-party submitters to register with CISA as a known third-party submitter. 108 106 See, e.g., Comments submitted by Exelon Corp., CISA-2022-0010-0043; The Associations: AFPM, AGA, API, APGA, INGAA, LEPA, CISA-2022-0010-0057. 107 See, e.g., Comment submitted by the Association of Metropolitan Water Agencies, CISA-2022-0010-0088. 108 See, e.g., Comments submitted by BSA | The Software Alliance, CISA-2022-0010-0106; SAP, CISA-2022-0010-0114; Information Technology Industry Council, CISA-2022-0010-0097. ix. Comments on Data and Records Preservation Requirements Very few commenters offered recommendations related to data and records preservation requirements. Several of those that did recommended CISA not impose additional data and records preservation requirements on covered entities via the CIRCIA regulation, and instead defer to covered entities' existing legal obligations or specific requests from law enforcement. 109 Only one commenter offered suggestions on the type of information that covered entities should preserve, 110 while a small number of commenters recommended lengths of time for how long CISA should require information to be preserved. 111 109 See, e.g., Comments submitted by Mandiant, CISA-2022-0010-0120; Accenture, CISA-2022-0010-0077; USTelecom—The Broadband Association, CISA-2022-0010-0067. 110 See, e.g., Comment submitted by Sophos, Inc, CISA-2022-0010-0047 (recommending that information preserved should include at least all logs containing data related to the incident, such as network logs, system logs, and access logs; all correspondence with attackers, including any notes taken during any unrecorded interactions; all identified TTPs and indicators of compromise; all data related to any ransomware payment; and contact information of individuals and entities that provided tactical support in the incident response and investigation process). 111 See, e.g., Comments submitted by Sophos, Inc., CISA-2022-0010-0047; SAP, CISA-2022-0010-0114; National Association of Chemical Distributors, CISA-2022-0010-0056. x. Comments on Other Existing Cyber Incident Reporting Requirements and the Substantially Similar Reporting Exception Many commenters offered feedback on the breadth of existing Federal, SLTT, and international cyber incident reporting requirements, and the potential for overlap, conflict, or alignment between CIRCIA and those requirements. CISA will not summarize the specific reporting requirements that commenters mentioned, because CISA provides a high-level summary of these existing reporting requirements in Section III.B in this document. To avoid duplicative and burdensome reporting, several commenters recommended that CISA align its reporting requirements with existing Federal and SLTT requirements. 112 Commenters frequently recommended that CISA consult with other Federal departments and agencies with pre-existing regulatory authority in the commenters' particular sectors to avoid duplicative requirements in the CIRCIA regulation. Numerous commenters recommended that, alongside harmonization efforts, CISA should establish a single, national point of contact or process for mandatory cyber incident reporting, 113 suggesting that DHS or CISA serve as the primary or sole entity for receiving and disseminating cyber incident report information. 114 Many commenters, noting the language in CIRCIA to this effect, encouraged CISA to implement the reporting exemption for covered entities that submit cyber incident reports with substantially similar information to other Federal departments and agencies, within a substantially similar timeframe. 115 A few commenters offered criteria for determining whether a report submitted to another Federal entity constitutes “substantially similar reported information.” 116 Commenters also offered suggestions on which existing reporting obligations should be considered to include substantially similar information. These suggestions included the Cyber Incident Notification Requirements for Federally Insured Credit Unions (FICUs), located at 12 CFR 748.1; 117 the DFARS incident reporting requirement, located at 48 CFR 252.204-7012; 118 Cyber Security Event Notifications for Commercial Nuclear Power Reactors, located at 10 CFR 73.77; TSA Security Directive Pipeline-2021-01 series, Enhancing Pipeline Cybersecurity; 119 and the Health Insurance Portability and Accountability Act of 1996 (HIPAA) Breach Notification Rule, located at 45 CFR 164.400-414, and corresponding Health Information Technology for Economic and Clinical Health (HITECH) Act Health Breach Notification Rule, located at 16 CFR part 318, which applies to entities not subject to the HIPAA Breach Notification Rule. 120 112 See, e.g., Comments submitted by National Association of Secretaries of State, CISA-2022-0010-0054; OCHIN, CISA-2022-0010-0039; HIMSS Electronic Health Record Association, CISA-2022-0010-0040; Alliance for Automotive Innovation, CISA-2022-0010-0082; Lucid Motors, CISA-2022-0010-0078; Center for Democracy & Technology, CISA-2022-0010-0068. 113 See, e.g., Comments submitted by Indiana Municipal Power Agency, CISA-2022-0010-0018; HIMSS, CISA-2022-0010-0119; Exelon Corp., CISA-2022-0010-0043; MITRE, CISA-2022-0010-0073; Options Security Corporation, CISA-2022-0010-0160; Airport Council International North America, CISA-2022-0010-0135; Cameron Braatz, CISA-2022-0010-0154. 114 See, e.g., Comments submitted by The Associations, CISA-2022-0010-0057: AFPM, AGA, API, APGA, INGAA, LEPA; Google Cloud, CISA-2022-0010-; Express Association of America, CISA-2022-0010-0038; Workgroup for Electronic Data Interchange, CISA-2022-0010-0041; internet Infrastructure Coalition, CISA-2022-0010-0055; American Council of Life Insurers, CISA-2022-0010-0095; Business Roundtable, CISA-2022-0010-0115. 115 See, e.g., Comments submitted by the American Public Power Association and the Large Public Power Council, CISA-2022-00 [Text truncated at 120,000 characters. The full text is on the page linked above.] --- Source: Frix Law Library, https://www.frixlaw.com/law-library/documents/fr%3A2024-06526. Public record. Not legal advice.