Perhaps it is no longer necessary because CIRCIA is superseding it [0]? The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) was meant to go into effect this year, however, CISA has delayed the implementation to May 2026 according to a recent report [1].