hen faced with a cybersecurity incident, CISOs must contend with more than just the threat itself. They must also contend with a myriad of state incident reporting regulations and proposed regulations on the federal level. These reporting regulations have differing standards on what qualifies as an incident, on what timeline.

As such, the NTSC believes the best solution is for CISA to serve as the primary agency for all incident reporting requirements and as the only agency to which CISOs must report in the event of an incident. The Cyber Incident Reporting for Critical Infrastructure Act already designates CISA as the principal agency for critical infrastructure incident reporting. We would like to see that requirement expanded to cover all cyber incidents, not just those that impact critical infrastructure.

As such, the NTSC believes the best solution is for CISA to serve as the primary agency for all incident reporting requirements and as the only agency to which CISOs must report in the event of an incident. The Cyber Incident Reporting for Critical Infrastructure Act already designates CISA as the principal agency for critical infrastructure incident reporting. We would like to see that requirement expanded to cover all cyber incidents, not just those that impact critical infrastructure.

As such, the NTSC believes the best solution is for CISA to serve as the primary agency for all incident reporting requirements and as the only agency to which CISOs must report in the event of an incident. The Cyber Incident Reporting for Critical Infrastructure Act already designates CISA as the principal agency for critical infrastructure incident reporting. We would like to see that requirement expanded to cover all cyber incidents, not just those that impact critical infrastructure.

As such, the NTSC believes the best solution is for CISA to serve as the primary agency for all incident reporting requirements and as the only agency to which CISOs must report in the event of an incident. The Cyber Incident Reporting for Critical Infrastructure Act already designates CISA as the principal agency for critical infrastructure incident reporting. We would like to see that requirement expanded to cover all cyber incidents, not just those that impact critical infrastructure.

As such, the NTSC believes the best solution is for CISA to serve as the primary agency for all incident reporting requirements and as the only agency to which CISOs must report in the event of an incident. The Cyber Incident Reporting for Critical Infrastructure Act already designates CISA as the principal agency for critical infrastructure incident reporting. We would like to see that requirement expanded to cover all cyber incidents, not just those that impact critical infrastructure.

As such, the NTSC believes the best solution is for CISA to serve as the primary agency for all incident reporting requirements and as the only agency to which CISOs must report in the event of an incident. The Cyber Incident Reporting for Critical Infrastructure Act already designates CISA as the principal agency for critical infrastructure incident reporting. We would like to see that requirement expanded to cover all cyber incidents, not just those that impact critical infrastructure.