Groups Urge Risk-Based Approach for Covered Entities for Cyber Incident Reporting

The Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) should define “covered entities” for cyber incident reporting in a risk-based manner, the American Public Power Association (APPA) and the Large Public Power Council (LPPC) said in response to a request for information (RFI) issued by CISA on the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA).