One report, many missions: A better way to coordinate America’s cyber defense

America has spent more than two decades building the institutions, authorities, partnerships, and regulatory frameworks needed to secure a country increasingly dependent on digital infrastructure.

That work has created enormous capability and considerable complexity. A major cyber incident affecting critical infrastructure can trigger obligations to multiple federal agencies, each operating under different authorities, timelines, definitions, and responsibilities.

As a company works to understand an adversary, contain an intrusion, restore operations, and protect the people who depend on its services, it may also be navigating multiple parts of the federal government.

The Cyber Incident Reporting for Critical Infrastructure Act of 2002, or CIRCIA, provides a framework to improve that system. Congress enacted the law to give the federal government greater visibility into significant cyber incidents affecting critical infrastructure.

The Cybersecurity and Infrastructure Security Agency (CISA) is working toward the final rule that will turn that mandate into an operating framework. The administration has also emphasized reducing unnecessary regulatory burdens and improving coordination across the federal government. CIRCIA provides an opportunity to advance both objectives at once.

A company that submits a complete, compliant incident report to CISA should be able to rely on the federal government to move that information to the appropriate agencies. CISA should be responsible for coordinating the transfer, and the protections governing the original submission should follow the information throughout the federal government.

The reporting company should not incur additional liability or compliance risk based on how the government subsequently shares or handles that information. Federal partners can then use the shared information in accordance with their authorities and responsibilities and seek additional information when their distinct missions require it.

CISA was built to make that model work. Its mission connects government, industry, and critical infrastructure. It operates across sectors, maintains operational relationships with owners and operators, and synthesizes information from individual incidents into a broader understanding of adversary activity.

CISA's role is especially valuable because cyberattack campaigns often become visible only when information from multiple victims is combined. One company may see unusual authentication activity, another may discover malware, and a third may experience operational disruption. Individually, those events may appear isolated. Combined quickly enough, they can reveal a broader campaign.

This is where incident reporting becomes an operational capability for national cyber defense. The system's value should be measured by what CISA does after a report arrives: It combines that information with other sources, identifies patterns, generates defensive insights, and returns useful information to the organizations that need it.

Information from one victim can then help protect others, giving the country greater visibility into adversary activity and a better opportunity to act before an individual incident escalates into a broader campaign.

Congress incorporated much of this model into CIRCIA. The law requires federal agencies that receive covered cyber-incident information to share it with CISA and mandates that CISA make it available to appropriate federal partners.

It also directs CISA to identify actionable indicators, disseminate defensive measures, and use incident information to help prevent similar events. These provisions lay the foundation for a coordinated federal system built on shared information and collective defense.

A coordinated system should also preserve the distinct responsibilities of the agencies receiving that information. CISA may use incident information to understand threats and strengthen collective defense. The FBI may use related information to investigate or disrupt malicious activity. A sector regulator may need it to assess the reliability or safety of an essential service.

Other agencies may have responsibilities involving investors, consumers, privacy, procurement, or national security. Those missions overlap yet remain distinct, and harmonization should focus on how information is collected, shared, and used across government while preserving the authorities and responsibilities assigned to each agency.

A modern reporting framework can make coordination easier for everyone involved. Common data fields can reduce redundant submissions. Shared definitions can reduce ambiguity.

Aligned timelines can simplify reporting where operational and statutory requirements permit. Secure technical systems can route relevant information to authorized recipients, so a victim does not have to repeatedly reconstruct the same event for different parts of government.

The federal government should assume responsibility for integrating incident information across its agencies, allowing companies to focus on accurate reporting and responding to the incident itself.

CIRCIA's treatment of "substantially similar" reporting provides a foundation for broader harmonization. Information should be considered equivalent when it gives the government the insight it needs, regardless of which agency's form or portal collected it.

A common core of incident information can then move across the federal government, with agencies collecting additional information when their missions require it and the legal and technical infrastructure ensuring that information can be shared and used effectively.

In practice, that means designing federal reporting around the information government needs rather than the organizational boundaries through which it travels.

The same systems-based approach should guide CISA's determination of criticality. Cyber risk aligns more closely with dependencies, concentration, and consequences than with company size.

A relatively small software provider, cloud service, or managed service provider may sit upstream of thousands of organizations across critical sectors. Criticality should reflect the functions an organization enables, the entities that depend on it, and the consequences of its disruption.

Federal cyber policy increasingly requires this kind of systemic thinking. Every reporting requirement should serve a purpose; every piece of collected information should reach someone who can use it; and every efficiency gained should strengthen national cyber defense.

America's cyber capability is distributed across federal agencies, private companies, infrastructure sectors, states, communities, law enforcement, intelligence organizations, and technology providers. Effective national cyber defense depends on connecting those capabilities through shared information, clear responsibilities, and coordinated action.

CIRCIA gives America an opportunity to make those connections more effective. Its legacy can extend well beyond a reporting rule by becoming part of the connective tissue that allows America to see threats earlier, respond faster, and turn information from one incident into protection for the next potential victim.