CISA reopens CIRCIA input window with new town hall schedule
A second stakeholder engagement round on a 2024 NPRM is the clearest signal yet that CISA's original reporting scope drew more opposition than the agency can absorb quietly.
TL;DR
CISA announced additional town hall meetings to collect stakeholder input on the CIRCIA Notice of Proposed Rulemaking first published April 4, 2024, which would mandate covered cyber incident and ransom payment reporting for critical infrastructure operators. The reopened window is a rare second bite: covered entities, primes, and their counsel can still argue for narrower scope or reduced reporting burden before CISA finalizes timelines and content requirements. Comment-period close date and any specific NPRM revisions under consideration were not disclosed in the notice.
CISA's decision to schedule additional town halls on the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) rulemaking is not a routine procedural step. Agencies that are satisfied with their NPRM record close the docket and draft the final rule. Reopening stakeholder engagement on a proposal already out since April 2024 signals the comment record was contentious enough to warrant re-engagement before CISA commits to final language on reporting timelines, covered-entity definitions, and ransom payment disclosure.
For critical infrastructure operators and their legal and compliance teams, the practical window is now. The notice does not specify a new comment-period close date or identify which NPRM provisions CISA is actively reconsidering, so the immediate task is monitoring the Federal Register docket for those details. The substantive leverage points remain the same ones that drove the original pushback: incident categorization thresholds, the 72-hour reporting clock, ransom payment disclosure mechanics, and the definition of "covered entity" across the 16 critical infrastructure sectors.
State CISOs and C3PAOs with critical infrastructure clients should treat this as the last realistic opportunity to move the scope needle before a final rule binds their constituents.
Published ·Updated ·Deep Fathom