The Cybersecurity Coalition, U.S. Chamber of Commerce, and 23 other organizations have requested a 30-day extension to the comment period for the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) from the Cybersecurity Infrastructure and Security Agency (CISA).

The Notice of Proposed Rulemaking (NPRM) was announced on April 4 and the comment period is open until June 3. The 26 organizations that have signed on to the letter are requesting to have comments close on July 3.

“The proposed rule is extensive and intricate, reflecting the complexities inherent in addressing cybersecurity within critical infrastructure sectors. The NPRM spans nearly 500 pages. Consequently, its length and depth necessitate a comprehensive review process to ensure that all stakeholders fully understand its implications,” the letter states.

Considering that the rules will impact every critical infrastructure sector, and potentially serve as a model for others, extending the comment period is sensible. The extension will give stakeholders the necessary time to review and evaluate the requirements, identify challenges, and propose solutions.

‍

The full letter and list of co-signers can be found here.

Read Next

Blog Post
•
Government

What States Can Learn from North Carolina’s Approach to Securing Government

As states across the country grapple with how to adopt AI responsibly, North Carolina offers a compelling case study - not because it has all the answers, but because it has built the institutional muscle to learn, adapt, and lead.

Papers & Reports
•
Government

Developing a National Cybersecurity Strategy

Developing a national cybersecurity strategy is a critical investment a government can make to secure its future. This paper outlines the components and offers a framework with the tools to design, implement, and improve their strategies.

Blog Post
•
Government

FedRAMP Signals Acceleration of Requirements for Machine-Readable Packages in the Rev5 Process

FedRAMP has proposed modifications to the Rev5 process in the newly published RFCs that could enact major changes and require Cloud Service Offerings to provide authorization packages in a “machine-readable format.”