Ending the Game of Telephone: The Future of Cyber Incident Reporting
summary
April 4 NPRM proposes a 38‑page rule inside ~470 pages of explanation, after 27 listening sessions and ~140 RFI responses; comment period extends from 60 to 90 days. CIRCIA requires reporting by covered entity of a covered incident, lets third parties submit, and aims to detect campaigns earlier; CISA handles ~130–150k incident tickets annually, seeks more funding to scale analytics and sharing, and limits use of CIRCIA data for enforcement unless another regulator’s rule already applies (substantially similar).
AI-written summary · about
chapters (20)
- 0:00Cyber incident reporting intro
- 1:07CIRCIA legislative history
- 4:17CISA implementation process
- 8:14IT sector on CIRCIA/NPRM
- 10:26CIRCIA's incident reporting purpose
- 13:41Congress and CIRCIA intent
- 15:47Next steps oversight feedback
- 17:54CIRCIA rulemaking challenges
- 20:26CISA voluntary to regulatory
- 24:25Building CIRCIA confidence
- 25:28CISA incident reporting now
- 29:00CIRCIA enforcement limits
- 31:52Bidirectional info sharing needs
- 33:47JCDC collaborative defense
- 36:57CIRCIA data for security
- 39:27CIRCIA funding challenges
- 41:18Congress supports CISA budget
- 42:21Third-party reporting roles
- 44:49CIRCIA and national security
- 46:14Q&A enforcement sharing
related talks
50mCyber Invisibility: Developing a Security Incident Notification Regime
49mIR: Optimizing Communications and Action Between Legal and Tech Leaders
01h 01mNIS2 & CRA: Europe's Response to Cyber Shenanigans
01h 05mCritical Information Infrastructure (CII) Protection: Challenges & Opportunities
55mWho You Gonna Call: The Quest for a National Data Breach Reporting Law
42mPreparing for the New Era of Cybersecurity Disclosure
15mEuropean Cybersecurity Regulations who's who
55mCybersecurity as Realpolitik