Critical infrastructure organizations want CISA to dial back cyber reporting

Public feedback on the proposed cyber incident reporting mandate for critical infrastructure, CIRCIA, highlights a call from the industry for reduced requirements and clearer definitions. The feedback, received by the Cybersecurity and Infrastructure Security Agency (CISA), underscores concerns about the broadly defined scope of a cyber incident, potential overwhelming of CISA’s resources, and the implications of mandatory ransomware payment reporting. Concerns also arise over which organizations should report and the lack of resources for implementation, with suggestions for financial incentives over penalties. Issues of harmonization with existing regulations and the efficacy of information sharing by the federal government further complicate the mandate's acceptance and effectiveness.

Opens on Cyberscoop