CISA is nearly done writing the proposed rules for cyber incident reporting, while the CMMC rules may be out for comment before the end of 2023.