I'm not a legal expert but this CISA act of 2015 sounds like something that's being superseded by Cyber Incident Reporting for Critical Infrastructure Act of 20

I'm not a legal expert but this CISA act of 2015 sounds like something that's being superseded by Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). CIRCIA goes into effect 2026Q2.