Water sector groups urge CISA to align sector-specific covered entity definition with SEC disclosure rulemaking

The Cybersecurity and Infrastructure Security Agency's proposed incident reporting rule should be scoped for the water sector to only address investor-owned water utilities currently required to disclose cyber incidents to Securities and Exchange Commission, according to a coalition of trade associations.

The water-focused coalition requests in their June 28 comments to CISA that the agency "redefine ‘covered entities’ in the final rule to include only water systems currently subject to the SEC reporting obligations,” in order to follow the...