CISA's Proposed Cyber Incident Reporting Requirements Would Hit A Range Of Industries And Sectors

The U.S. Department of Homeland Security's (DHS) Cybersecurity and Infrastructure Security Agency (CISA) is publishing a proposed rule (Proposal or NPRM) that will require broad segments of industry to meet onerous and quick reporting requirements following certain cyber incidents. This new incident reporting framework – if adopted as proposed – would mark a sea change in the already complicated cybersecurity incident reporting landscape. Put simply, CISA proposes to require reporting of many incidents, on a very short timeframe by larger segments of the private sector than are currently required to make reports under U.S. cybersecurity and incident reporting laws. In taking a broad view of its authorities and the goals that Congress sought to promote in the law, CISA has proposed a complex and sweeping regulatory regime that has not been harmonized with existing federal cyber incident reporting requirements.