Biden Signs Into Law Critical Infrastructure Ransomware Payment And Cyber Incident Reporting

On March 15, 2022, President Biden enacted, through an omnibus spending package, the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (the “Act”). The Act establishes two cyber incident reporting requirements for “covered” critical infrastructure entities: (1) a 24-hour requirement to report ransomware payments to the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and (2) a 72-hour requirement to report all covered cyber incidents to CISA. The reporting requirements will take effect once CISA issues the necessary implementing regulations. Most companies will need to build or improve their incident reporting and crisis response plans to comply with these tight requirements—such incident response plans are highly advisable in general, and now more so ahead of the pending regulatory requirements.