CISA to host industry feedback sessions on cyber incident reporting regulation

CISA plans sector-by-sector virtual town halls, followed by general sessions on March 31 and April 2, to gather additional input on the CIRCIA proposed rule that would require critical infrastructure owners and operators to report significant cyberattacks within 72 hours and ransomware payments within 24 hours. The sessions will seek feedback on sector-based applicability criteria, treatment of small businesses, considerations for chemical facilities amid a lapsed security law, example reportable incidents, and alignment with existing regulations, while some industry stakeholders argue for more two-way dialogue; a senior CISA official indicated further CIRCIA updates are expected soon.