CISA incident reporting interagency review opens new opportunity for stakeholders to weigh in on upcoming final rules

The 2022 Cyber Incident Reporting for Critical Infrastructure Act directed CISA to create a mandatory regime where covered entities would be required to report cyber incidents within 72 hours and 24 hours for a ransom payment. CISA issued a notice of proposed rulemaking in April 2024. The law provided CISA 18 months to finalize the rulemaking but CISA has pushed the deadline twice, extending the anticipated date to September 2026.

CISA did not meet the September deadline but submitted the final rules on Oct. 1 to OMB’s Office of Information and Regulatory Affairs to start the interagency review process. There is a 90-day window to complete the interagency review process, which can be extended.

The new timeline sets an anticipated publication of the final rules in early January. “OMB review creates a potential opportunity for companies, trade associations, and other stakeholders to engage directly with the Administration through the Executive Order 12866 meeting process while OMB is reviewing the draft final rule,” according to an Oct. 6 post from law firm Wiley.

OIRA scheduled two meetings this week under the EO 12866 meeting process. The National Association of Manufacturers will meet Oct. 21 with OIRA officials and CISA representatives.

On Oct. 28, Airlines for America is scheduled to meet with OIRA officials and CISA representatives under the interagency review process. The Wiley post highlights how the OIRA review sets up a window for “last-minute engagement” for industry with the Trump administration before the rulemaking is final.

“Stakeholders that participated in the rulemaking to date may wish to consider requesting meetings with OMB to discuss unresolved concerns, particularly those relating to regulatory harmonization, duplicative reporting obligations, implementation timelines, and compliance burdens,” the post says. The post emphasizes that organizations “should move quickly” to set up an EO 12866 meeting because the draft final rules could be cleared “for publication in just a few weeks.” The length of the interagency review process typically depends on the significance of the rulemaking, the parties involved and the priorities of the current administration in the White House. The CISA final rules are a high priority for a wide range of stakeholders who are closely watching to see if the agency makes any changes to the 2024 NPRM.

CISA held a town hall series in June to get additional feedback to the upcoming final rules but has provided little insight on potential changes. CISA described in a Feb. 13 Federal Register notice the areas where more feedback would be helpful, as part of the initial announcement for the town halls.