Joint Trades Letter to CISA on Cyber Incident Reporting Requirements

Dear Director Easterly,

The American Bankers Association (the "ABA"), Bank Policy Institute (the "BPI"), Institute of International Bankers (the "IIB"), and the Securities Industry and Financial Markets Association ("SIFMA") (together, "the Associations") appreciate the opportunity to comment on the Cybersecurity & Infrastructure Security Agency's ("CISA" or the "Agency") rule proposal on the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (the "Proposal" or "Proposed Rule") on behalf of the financial services industry.

The Associations recognize the benefits of sharing threat intelligence and incident information that will enable CISA to provide valuable tools and information to help defend the nation’s critical infrastructure. The Associations appreciate CISA's objective to introduce clearly defined reporting requirements that will support trend analysis, vulnerability identification, provision of early warnings, and other key national security purposes.

However, the Proposal extends beyond the authorities granted to it under the statute and departs substantially from what Congress intended when it enacted CIRCIA. At that time, Congress was careful to note that CIRCIA sought to strike "a balance between getting information quickly and letting victims respond to an attack without imposing burdensome requirements." Congress also reiterated that CIRCIA should be implemented "in a way that accounts for the practical needs of industry." The Proposed Rule falls short of these critical considerations.

The Proposal itself requires reporting of more detailed and expansive data elements than observed in any of the current cyber regulatory reporting requirements, thereby prioritizing routine government reporting over more critical and impactful response and remediation work and potentially increasing operational risks. The proposed reporting requirements essentially mean that Congress's intention to create a "substantially similar" exception for reporting to other regulators was simply ignored. Congress clearly envisioned more limited reporting given that Congress believes there would be some exempted reporting due to existing regulations.

Download the joint comment letter to read the full text.