Financial Trades urge CISA to rescind cyber reporting rule

A coalition of financial trade associations has urged the Cybersecurity and Infrastructure Security Agency to rescind and reissue its proposed cyber incident reporting rule to implement the Cyber Incident Reporting for Critical Infrastructure Act. The groups — including the Bank Policy Institute, American Bankers Association, Institute of International Bankers and the Securities Industry and Financial […]

A coalition of financial trade associations has urged the Cybersecurity and Infrastructure Security Agency to rescind and reissue its proposed cyber incident reporting rule to implement the Cyber Incident Reporting for Critical Infrastructure Act.

The groups — including the Bank Policy Institute, American Bankers Association, Institute of International Bankers and the Securities Industry and Financial Markets Association — warn that the proposed rule diverges from congressional intent, imposes unnecessary burdens and shifts critical cybersecurity resources away from defending institutions and their customers.

“We believe the proposed rule will have significant and detrimental repercussions if not substantially revised,” the Associations wrote. “As such, we ask that you work with industry to craft a new rule that allows a victim company to focus its resources on responding to an attack rather than filing government reports.”

They said CIRCIA, signed into law in March 2022, was championed by bipartisan lawmakers to strengthen cyber incident reporting without creating undue burdens.

However, key congressional leaders now express concern that CISA’s proposed rule exceeds its mandate.