ITI: To Safeguard U.S. Cybersecurity, CISA Must Improve CIRCIA Rulemaking
WASHINGTON – Today, global tech trade association ITI called on the Cybersecurity and Infrastructure Security Agency’s (CISA) to make its incident reporting regulation more effective and actionable in order to safeguard U.S. cybersecurity. ITI responded (opens in a new tab) to CISA’s Notice of Proposed Rulemaking (NPRM) implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) with key recommendations to target the scope of the rule and take a more proactive role in harmonization in the U.S. and around the world.
“Given the broad scope of the rule and the amount of information requested, we are concerned that CIRCIA in its current state will inevitably lead to overreporting of minor and potentially out of scope incidents. Such myriad reports will risk burying significant cyber trends in irrelevant data, and significantly decrease the benefit of the reporting scheme,” ITI wrote in its comments. “Further, we are concerned about the broad scope of the definitions of substantial cyber incident and covered entity. The definition of covered entity is very broad, and CISA should provide further guidance to provide certainty to companies as to whether or not they are in scope as a ‘covered entity.’”
“We encourage CISA to take a more proactive role in harmonizing incident reporting requirements, particularly through the CIRC, to converge incident reporting, and explore whether a single, national reporting function is feasible,” ITI continued.
ITI’s submission (opens in a new tab) recommends that CISA:
- Take a more assertive role in harmonizing CIRCIA with existing and forthcoming U.S. reporting requirements;
- Target the scope of the rule, including narrowing the scope of “covered entity” and refining the definition of “covered cyber incident;”
- Allow for flexibility around supplemental reporting;
- Consider the security implications and potential vulnerabilities associated with sharing and storing reports;
- Tailor the information requested in the initial report to reflect the reality that some information may not be available immediately after an incident occurs;
- Uphold the liability protections provided in CIRCIA 2022; and
- Take steps to foster reciprocity and better ensure that CIRCIA provides value to stakeholders.
A longstanding tenet of ITI’s position on incident reporting has been the importance of alignment within the United States and around the world. In its comments, ITI emphasizes that CISA should not only examine the existing federal, state, and local incident reporting landscape—but also take into account the international landscape and collaborate with partners to harmonize where possible.
ITI has been deeply engaged in work on cybersecurity incident reporting policy development around the world, including in Australia, Europe, and the United States. As a part of its engagement, ITI developed and released two sets of policy principles: Policy Principles for Security Incident Reporting in the U.S. (opens in a new tab) and Global Policy Principles for Cybersecurity Incident Reporting. (opens in a new tab) These documents are intended to help inform and guide policymakers as they consider how to best approach mandatory cyber incident reporting policies and reflect ITI’s view of the components that make up a thoughtful approach to incident reporting.
Related News & Analysis
Why an AI ‘Kill Switch’ isn’t a Catch-all Solution
AI is Supercharging Cyber Threats. Defenders Need New Tools and Partnerships.
