CISA’s incident reporting requirements go too far, trade groups and lawmakers say

Industry and lawmakers at a House cybersecurity subcommittee hearing criticized CISA’s 447-page draft rule requiring critical infrastructure to report significant cyber incidents within 72 hours and ransomware payments within 24 hours, warning its broad scope could overwhelm CISA and burden smaller entities. Witnesses urged clearer definitions, harmonization with existing mandates, and questioned CISA’s subject-matter capacity and data-protection track record, while lawmakers signaled intent to narrow the rule to focus on truly significant incidents.