As the U.S. Congress moves closer to enacting a federal cyber incident reporting requirement (and as the administration fractures over how best to craft it), it is important to remember that there is another path — the federal government's partnership with the fifty states.