Without a federal incident reporting law, CISA and the private sector lack efficient information-sharing capabilites, Director Jen Easterly said.