Homeland Security lawmakers react to six-month delay of CISA mandatory incident reporting final rule

Leaders on the House and Senate Homeland Security committees expressed mixed reactions toward a CISA decision to delay the publication of a final rule to establish a mandatory incident reporting regime, as required by a 2022 law.

The Cybersecurity and Infrastructure Security Agency confirmed plans to Inside Cybersecurity on Sept. 4 to publish the final rule in May 2026. Under the 2022 Cyber Incident Reporting for Critical Infrastructure Act, CISA published a notice of proposed rulemaking in April...