Last Call for Public Comment on DHS Cyber Incident Reporting Rules: CISA Sends CIRCIA Final Rule to OMB, Opening Window for Last-Minute Stakeholder Engagement

The Cybersecurity and Infrastructure Security Agency's (CISA) long-awaited rule implementing the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) has advanced to White House Office of Management and Budget (OMB) review. The CIRCIA rules will require many companies in “critical infrastructure” sectors to report cyber incidents to CISA within 72 hours of having a reasonable belief that an incident that must be reported has occurred.

OMB’s review signals that the rulemaking process may be approaching its final stages. Although the text of the draft final rule has not been released publicly, OMB review of a draft final rule provides one of the final opportunities for stakeholders to engage with the Administration before the rule is finalized.

As outlined in our previous review of CISA’s notice of proposed rulemaking (NPRM), the proposed CIRCIA rule would establish a broad federal cyber incident reporting regime for covered critical infrastructure entities, including requirements to report certain cyber incidents and ransom payments to CISA on short time frames. The NPRM prompted significant stakeholder feedback on issues including the scope of covered entities, incident reporting triggers, reporting timelines, recordkeeping requirements, and the need to harmonize CIRCIA with existing federal, state, and international reporting obligations.

A Narrow Window for OMB Advocacy

OMB review creates a potential opportunity for companies, trade associations, and other stakeholders to engage directly with the Administration through the Executive Order (EO) 12866 meeting process while OMB is reviewing the draft final rule. Stakeholders that participated in the rulemaking to date may wish to consider requesting meetings with OMB to discuss unresolved concerns, particularly those relating to regulatory harmonization, duplicative reporting obligations, implementation timelines, and compliance burdens. Historically, OMB has cleared many draft final rules for publication in just a few weeks, so organizations that may wish to set up an EO 12866 meeting should move quickly.

Key Issues to Watch

Because the draft final rule is not publicly available, stakeholders may wish to advocate to OMB about:

• Harmonization with other cyber incident reporting regimes;
• The scope of covered entities and reportable incidents;
• Reporting timelines and required report contents;
• Recordkeeping obligations; and
• The overall compliance burden on regulated entities.

It remains unclear how extensively CISA modified the proposed rule in response to stakeholder feedback. However, the volume of comments received and the consistent focus on harmonization and burden reduction suggest these issues are likely to be at the top of the list for industry at this late stage.

Stakeholders Can Still Be Heard

Stakeholders with outstanding concerns regarding harmonization, duplicative reporting obligations, implementation challenges, or overall compliance burdens should consider acting promptly. For many organizations, the ongoing OMB review may represent one of the last meaningful opportunities to advocate for changes before the final rule is issued. And while the rules are not yet final, it is not too soon to begin planning for implementation, particularly if your organization is not currently subject to mandatory cyber incident reporting requirements.

*****

Wiley’s Privacy, Cyber & Data Governance team has helped companies of all sizes from various sectors proactively address risks and compliance with new cybersecurity laws and requirements. Our team has been actively involved in advocacy to CISA on these new rules. Please reach out to any of the authors with questions.