ACD Press Release

ACD Testifies Before CISA on CIRCIA Applicability Criteria, Encourages Agency to Streamline Cyber Incident Reporting Requirements

Arlington, VA –Last week, Douglas A. Leigh III, Vice President of Legislative Affairs at the Alliance for Chemical Distribution (ACD), delivered testimony to the Cybersecurity and Infrastructure Security Agency (CISA) as it gathers stakeholder input on the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) notice of proposed rulemaking.

In his remarks, Leigh urged CISA to refine the scope of the proposed rule and reduce unnecessary burden by targeting reporting requirements to truly high-risk facilities. He emphasized that, with the expiration of the Chemical Facility Anti-Terrorism Standard, CISA should adopt an approach modeled on the expired program's Appendix A hazardous-release chemicals thresholds to ensure the rule captures facilities that present the greatest security risks. Leigh cautioned that relying on broader criteria, such as those tied to EPA’s Risk Management Program, would dramatically expand the number of covered entities, overwhelm CISA with excessive reporting, and ultimately undermine the agency’s ability to respond quickly and effectively to cyber incidents affecting critical infrastructure.

“Due to the lack of CFATS reauthorization, ACD recommends that CISA follow the Federal Aviation Administration’s (FAA) Notice of Proposed Rulemaking, “Designation - Restrict the Operation of Unmanned Aircraft in Close Proximity to a Fixed Site Facility,” implementing Section 2209 of the FAA Extension, Safety, and Security Act of 2016, as amended, in its approach to establish chemical sector-based applicability criteria.”

Additionally, Leigh highlighted that more than 300,000 entities would be subject to this rulemaking, placing additional burdens on facilities while making it difficult for the agency to review an overwhelming number of CIRCIA reports. Leigh called on CISA to optimize facility reporting to ensure the Agency can promptly inform members about possible threats.

“ACD strongly urges CISA to utilize hazardous-release chemicals listed in Appendix A as the chemical sector-based criteria alternative to limit the number of covered entities to those at high risk of being targets, so that the Agency can respond to incidents effectively and support critical infrastructure security.”

Leigh concluded, “CIRCIA has the potential to streamline federal cyber incident reporting requirements and strengthen the country’s cyber defense response. ACD emphasizes the need for targeted and streamlined reporting requirements to facilitate an efficient response to cyber incidents and underscores the need for safe and secure data handling.”

To read ACD’s full testimony before the CISA, click here.

###

The Alliance for Chemical Distribution (ACD) partners with our more than 400 chemical distribution industry members to provide the education, connection, standards, and advocacy they need to responsibly move the essential products our world depends on. As leaders in the $27B+ chemical distribution industry, ACD member companies commit to the highest standards in quality, safety, sustainability, and performance through ACD Responsible Distribution^TM. For more information, visit www.acd-chem.com.