CISA Courts Private Sector to Get Behind CIRCIA Reporting Rules

At RSA Conference 2024, CISA announced a 30-day extension for public feedback on proposed CIRCIA incident-reporting rules, urging the private sector to view sharing incident data as a collective defense measure while acknowledging the agency’s limited resources. Panelists warned that additional disclosure mandates could add red tape for breach victims and potentially slow response, even as CISA seeks to streamline overlapping federal and state reporting by serving as a centralized repository and working through the JCDC. Industry participants called for clearer definitions of covered entities and covered incidents, with comments accepted via the Federal Register through July 3.