Industry Pushes Back on CISA Cyber Incident Reporting Rule as CIRCIA September Deadline Faces Doubt

CISA released transcripts last week from four June town halls, attended by roughly 1,200 critical infrastructure stakeholders, where industry groups pressed to narrow the 300,000 entities CISA estimates are covered under the CIRCIA rule and cut required incident and data reporting 1. Named examples included the Nuclear Energy Institute's push to limit coverage to NRC-regulated entities, a Nebraska Public Power District official's worry that routine network scans could trigger mandatory reports, and trade groups including the Auto Care Association, Alliance for Chemical Distribution, AHIP, and Business Software Alliance urging fewer covered companies and exclusion of security-measure details from reports . The administration has set a September target to finalize the rule after missing an October 2025 deadline and a May reset date, but industry sources told CyberScoop they doubt CISA will meet it . The House Appropriations Committee's fiscal 2027 DHS spending bill urged CISA to finalize the rule promptly, and CISA cited funding lapses for the delay . CISA acting director Nick Andersen pushed back at the town halls, telling attendees CIRCIA is not a check-the-box compliance exercise but is meant to improve visibility into the cyberthreat landscape .