US Government Seeks Mandatory Cyber & Ransomware Reporting Requirements

In the wake of recent high-profile cyber and ransomware attacks, Congress and the Biden administration have joined forces, in an increasingly rare show of bipartisanship, to drive policy changes that would require many entities to report certain cyber incidents to the federal government. Importantly, the legislation would give entities 72-hours to report a cyber incident. This is especially notable given all the media attention calling for a 24-hour notification requirement.

Estimates suggest that at least 85% of the nation's non-defense, critical infrastructure is owned by the private sector. To date, the federal government has had limited authority over civilian cyber matters, and in some areas (e.g., ransomware) an even more limited understanding of the nature of the threat. Bad actors can range from the lone wolf, to sophisticated criminal and terrorist networks, to nation states intent on doing harm. Cyber threat actors are constantly evolving new tactics and