CISA faces resource challenge in implementing cyber reporting rules

CISA released a 447-page notice of proposed rulemaking to implement CIRCIA’s breach reporting requirements for critical infrastructure, opening a 60-day comment period and setting an 18-month ramp-up for implementation. The report outlines key challenges—ambiguous definitions of covered/reportable incidents, the expected influx of ~25,000 annual reports, and how CISA will analyze, anonymize, and share actionable insights—amid budget shortfalls and its evolving regulatory role. Experts urge both industry and CISA to prepare for rapid, accurate reporting, scalable triage, and selective government response to maintain trust and deliver utility.