Critical infrastructure organizations want CISA to dial back cyber reporting

**Executive summary:** The document summarizes industry and stakeholder public comments on CISA's proposed CIRCIA reporting rule, highlighting calls for narrower definitions of "substantial cyber incident," clearer reporting scopes and exclusions, adjusted thresholds for covered entities, concerns about the burden of reporting (including ransomware payment disclosure), the need to harmonize with existing sector regulations, and skepticism about the federal government's ability and willingness to protect and share collected information appropriately.