Cybersecurity Policy Report, CISA Went Too Far With Cyber Incident Reporting Rules, Lawmakers Told, (May 1, 2024)

By Tom Leithauser

Rules proposed by the Cybersecurity and Infrastructure Security Agency to implement the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) are overly broad and will undermine the intent of the law, witnesses and lawmakers said today at a House subcommittee hearing.

CISA recently published a notice of proposed rulemaking (NPRM) to implement CIRCIA that included expansive definitions of entities and incidents that should be covered by the rules (CPR, March 27).

Those definitions should be scaled back to prevent overreporting, which would burden both private sector entities required to report incidents and CISA’s efforts to ingest and analyze the reports, witnesses told the House Homeland Security Committee’s cybersecurity and infrastructure protection subcommittee.

“The proposed scope of ‘covered entities’ and ‘covered cyber incident’ are expansive and currently lack key guidance that cybersecurity practitioners will need, as they seek to provide CISA with information that is responsive to the agency’s mission,” Robert Mayer, USTelecom’s senior vice president–cybersecurity and innovation, said in written testimony.

“Moreover, it is imperative for our government partners to recognize the substantial cyber resources that will be allocated to assess whether an event meets the reporting criteria,” Mr. Mayer testified.

“The industry requires more precise definitions and clear reporting thresholds. Without these, there is a real risk that, in an effort to comply with the law, the industry will report numerous events that could easily overwhelm CISA’s capacity to act on the information,” he said.

“Such overreporting could unnecessarily burden government resources and undermine the effectiveness of CIRCIA. It is crucial to establish definitions that are not excessively broad, as overly inclusive terms could divert essential resources away from cyber defense and towards regulatory compliance for its own sake,” he added.

Other witnesses from the electric and financial services industries agreed. Heather Hogsett, SVP–technology and risk strategy at BITS, the Bank Policy Institute’s technology policy division, noted that cyber defenders in the financial services sector were already spending a significant amount of time on regulatory compliance rather than fighting hackers.

“While we continue to believe that CIRCIA will play an important role in our collective defense against nation-state attacks and malicious criminals, we urge CISA to substantially revise the proposed rule in several key areas to ensure its requirements are simple and directly support CISA’s ability to have better awareness of significant cyber incidents; to quickly provide useful information to critical infrastructure; and to allow cyber personnel to focus on response and recovery rather than government reporting,” Ms. Hogsett said in written testimony.

“As currently drafted, this proposal will require extensive efforts by critical personnel during the most critical phase of an incident and includes expectations for ongoing updates. When combined with a low threshold for reporting and other existing regulatory reporting requirements, this will add significant burden and compliance obligations,” she said.

The witnesses also complained that they faced multiple and conflicting reporting requirements from other regulatory agencies and said regulatory harmonization should be a greater priority.

The electricity sector has existing cyber incident reporting obligations imposed by the Federal Energy Regulatory Commission and Department of Energy, according to Scott Aaronson, SVP–security and preparedness at the Edison Electric Institute (EEI).

CISA should take advantage to the greatest extent possible of a provision of CIRCIA that allows it to reach agreements with other federal agencies to use their cyber incident reporting mechanisms in cases where their reporting regime is “substantially similar” to the one envisioned by CIRCIA, Mr. Aaronson said.

“CISA should thoroughly explore opportunities with federal counterparts to limit duplicative reporting through the ‘substantially similar’ exception of CIRCIA,” he stated in written testimony.

“This exception includes ‘when a covered entity reports substantially similar information in a substantially similar timeframe to another Federal agency pursuant to an existing law, regulation, or contract when a CIRCIA Agreement is in place between CISA and the other Federal agency.’ Accounting for and leveraging these existing incident reporting requirements should be a priority for CISA,” he added.

He noted that EEI was among a collection of trade associations that asked CISA to extend the comment deadline for the CIRCIA NPRM by 30 days, from June 3 to July 3 (CPR, April 5).

Subcommittee leaders today announced that CISA had agreed to extend the comment period, although an official notice had not been issued by CPR’s news deadline.

Lawmakers, both Democrats and Republicans, expressed agreement with the witnesses’ assessment of the scope of the CIRCIA NPRM.

“New technology may enable CISA to draw insights from a higher volume of CIRCIA reports more quickly, particularly the advancements in AI. But I question whether it will be able to adequately overcome complications from the kind of overreporting that is likely to occur, given the breadth of current definitions. Implementation of CIRCIA will be expensive for both the government and private sector, and we must ensure that it yields real value,” said Rep. Eric Swalwell (D., Calif.), the panel’s ranking member.

Rep. Yvette Clarke (D., N.Y.), one of the authors of CIRCIA, recalled that the legislation’s drafters didn’t expect “all critical infrastructure owners and operators to be subject to this reporting requirement. Rather we expected it to apply only to a subset.”

“Additionally, our intent was that reporting requirements would be appropriately tailored to limit overreporting and ensure that CIRCIA ultimately yields the security benefits we intended,” Rep. Clarke said. “We did not intend to subject every one or every incident to reporting.”

“With nation-state actors such as China and Russia continuing to target us, we knew that we needed to better understand and defend against increasingly fraught cyber threats,” said Rep. Mark Green (R., Tenn.), chairman of the full committee.

“However, we knew we needed to do this without imposing undue regulatory burden on our companies that are already stretched very thin,” Rep. Green said. “Duplicative efforts tend to wind up costing businesses money that they could actually use on real cybersecurity, and so getting to the bottom of those is one of our priorities.”

MainStory: TopStory DataSecurity FederalLegislation