Joint Trades Letter to DHS/CISA Asking to Rescind the 2024 Proposed Rule

Dear Secretary Noem & Director Vought,

On behalf of the American Bankers Association, Bank Policy Institute, Institute of International Bankers, and the Securities Industry and Financial Markets Association, we request that you rescind and reissue the Cybersecurity and Infrastructure Security Agency's ("CISA") proposed rule to implement the Cyber Incident Reporting for Critical Infrastructure Act ("CIRCIA") in accordance with Executive Order 14219 and the Regulatory Freeze Pending Review Memorandum. We believe the proposed rule will have significant and detrimental repercussions if not substantially revised. As such, we ask that you work with industry to craft a new rule that allows a victim company to focus its resources on responding to an attack rather than filing government reports.

CIRCIA was enacted by Congress in March 2022 and tasked CISA with implementing many of the law’s key requirements. In accordance with that mandate, CISA published a notice of proposed rulemaking (“NPRM”) in April 2024. Among other things, that proposal included definitions for key terms, the content of incident reports, and thresholds for reporting.

We supported CIRCIA as it was being considered by Congress because it sought to establish a uniform incident reporting standard across all critical infrastructure sectors and provide CISA with the information necessary to better defend against attacks. Unfortunately, CISA's NPRM envisions a wide-ranging incident reporting regime that meaningfully departs from Congressional intent and would divert the attention of cyber first responders away from the critical tasks of response and recovery. This includes expansive thresholds for reporting that would capture de minimis outages to non-critical services and extensive data elements that, as currently drafted, will consume the finite time of critical personnel. It is therefore vital that CISA rescind its April 2024 NPRM and issue a new proposed rule that is not only more consistent with Congressional intent, but will also achieve CIRCIA’s central purpose to "enhance the situational awareness of cybersecurity threats across critical infrastructure sectors."

Download the joint comment letter to read the full text.