Well i think its a little of both. Technically i think epa overstepped its authority, but CISA is the exact place it should come from. Ideally any agency like this would work with CISA who has the mandate. Its certainly complicated when you get into an agency “making law” and theres a case in front of the supreme court now that could disrupt all of that.