ICI Comment Letter on the CIRCIA Proposal

In this letter the Investment Company Institute provides its views on the notice of proposed rulemaking on Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements from the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security. Investment companies and advisers registered with or regulated by the Securities and Exchange Commission—are financial services companies that exceed the proposed “small business size standard” and, thus, are within the proposal’s ambit. At the same time, the SEC has issued a proposal that, if adopted, will require SEC Registrants to establish cybersecurity risk management programs and make cyber incident reports that would overlap with CISA’s proposed incident reports.

Read more in the comment letter.