CISA Publishes Proposed Rule For Cyber Reporting

On April 4, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published its much-anticipated Notice of Proposed Rule Making for the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA).

CIRCIA was signed into law in March 2022 in response to a growing number of cyber threats and attacks on entities operating within certain critical infrastructure sectors. Under CIRCIA, companies within 16 identified critical infrastructure sectors will be required to report substantial cyberattacks within 72 hours "after the company reasonably believes the incident has occurred." Ransomware payments must also be reported within 24 hours of being made. Companies must also retain certain documentation for a two-year period following the incident.