CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act) CIRCIA-2242a5: Reporting Exceptions: Substantially Similar Reporting and DNS

Reporting is exempted where the entity is required by law/regulation/contract to report substantially similar information to another Federal agency within a substantially similar timeframe once a CIRCIA Agreement and sharing mechanism is in place; functions governed by DNS multistakeholder bodies (e.g. ICANN/IANA) are also excluded.

Other controls in CIRCIA: Required Reporting (Sec. 2242)

CIRCIA-2242a1 72-Hour Covered Cyber Incident Report
CIRCIA-2242a2 24-Hour Ransom Payment Report
CIRCIA-2242a3 Supplemental Reports
CIRCIA-2242a4 Preservation of Data Relevant to the Incident
CIRCIA-2242c4 Required Contents of a Covered Cyber Incident Report
CIRCIA-2242c5 Required Contents of a Ransom Payment Report
CIRCIA-2242d Third-Party Report Submission
CIRCIA-2242e Awareness of Reporting Obligations

Query this from an agent

The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.

MCP endpoint All CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act) controls