Douglas A. Leigh III, vice president of legislative affairs at the Alliance for Chemical Distribution (ACD), recently delivered testimony to the Cybersecurity and Infrastructure Security Agency (CISA) as it gathers stakeholder input on the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) notice of proposed rulemaking. Leigh urged CISA to refine the scope of the proposed rule and reduce unnecessary burden by targeting reporting requirements to truly high-risk facilities. He emphasized that, with the expiration of the Chemical Facility Anti-Terrorism Standard, CISA should adopt an approach modeled on the expired program's Appendix A hazardous-release chemicals thresholds to ensure the rule captures facilities that present the greatest security risks. He cautioned that relying on broader criteria, such as those tied to EPA’s Risk Management Program, would expand the number of covered entities, overwhelm CISA with excessive reporting, and ultimately undermine the agency’s ability to respond quickly and effectively to cyber incidents affecting critical infrastructure.

The ACD recommends that the CISA use the Federal Aviation Administration’s (FAA) Notice of Proposed Rulemaking, “Designation - Restrict the Operation of Unmanned Aircraft in Close Proximity to a Fixed Site Facility,” as it establishes a “chemical sector’based applicability criteria.” Specifically the ACD pointed to  Section 2209 of the FAA Extension, Safety, and Security Act of 2016, as amended.