Series
Blogs
US: Congress passes new cyber incident reporting requirement
US: Congress passes new cyber incident reporting requirement
15 March 2022
Series
Blogs
15 March 2022
The Cyber Incident Reporting for Critical Infrastructure Act (the “Act”), unanimously approved by the U.S. Senate on March 10, 2022, is the most significant cyber legislation to make it through the Senate since 2015. * Update - On 15 March 2022, President Biden signed the Act into law.
The Act requires critical infrastructure entities (e.g., financial services, energy, defense industrial base) and federal agencies to report significant cyber incidents to the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (“CISA”) within 72 hours of the incident and within 24 hours if a ransomware payment was made.
For most industries the 72-hour notice period is a significant departure from current and historic notification timelines in the U.S. and largely aligns with notification requirements set by the GDPR. The Act also solidifies CISA as the central information agency related to cyber incidents.
While this bill establishes minimum reporting standards for “covered entities”, further guidance is to be established by CISA. Therefore, once the Act is implemented, careful monitoring of CISA’s developments regarding the Act remains crucial for critical infrastructure entities across multiple industries to ensure compliance with reporting mandates.
The Act relates to entities in the Presidential Policy Directive 21, as further defined by CISA and is based on:
The definition of a “covered cyber incident” shall be later defined by CISA regulations, but at a minimum shall be defined as any occurrence that actually jeopardizes, without lawful authority, the integrity, confidentiality, or availability of information on an information system, or actually jeopardizes, without lawful authority, an information system, and must include, at a minimum:
Reports of cyber incidents to CISA shall include, where available:
If a ransomware payment was made, reports to CISA shall also include, where available:
Among the timely reporting requirements mentioned above, the Act calls for a “covered entity” to update prior submissions or reports if additional information becomes available or if a ransom payment is made at a later time. The Act also requires reporting entity to preserve relevant information and data about the “covered cyber incident” or ransom payment.
Even prior to the Act, due to the striking uptick in cyber incidents, CISA has provided guidance and recommendations for proper responses to ransomware attacks with tips to detect potential intrusions, and general best practices for cyber protection. The Act expands upon CISA’s role, establishing it as the central agency for cyber reporting with new programs and requirements regarding ransomware and cyber incident data:
The Act also authorizes CISA to issue requests for information and subpoenas to entities deemed non-compliant with reporting obligations. Requests for information may be sent to entities that CISA deems as maintaining an obligation to submit a notification. Failure to respond within 72 hours triggers CISA’s ability to issue subpoenas to entities and could lead to enforcement actions and a referral to the Department of Justice.
Reports provided to CISA under the Act will remain the commercial property of the covered entity. Moreover, the reports will be exempt from FOIA requests served on CISA and reports will not constitute a privilege waiver. Additionally, the Act protects covered entities from liabilities from filing a report with CISA.
The Act encourages organizations to be well-equipped to respond to cybersecurity and ransomware threats. This legislation also enables organizations to scrutinize their existing cyber defenses and solidify their existing cyber incident response plans.
The Act’s inclusion of breaches suffered by supply chain and cloud providers is greatly significant and largely expands on the coverage of such breaches. This will have a downstream effect and will likely create contract implications. In turn, this may require customers of suppliers to engage in a level of auditing not seen before. Companies should begin consideration of larger investment into their cyber infrastructure in order to ensure compliance with the guidance set forth in the Act. This legislation is a significant step in the collective cybersecurity of the U.S.