CISA Announces Proposed Cyber Incident Reporting Rule

On March 27, 2024, the Cybersecurity and Infrastructure Security Agency (CISA), an operational component of the Department of Homeland Security (DHS), posted for public inspection its long-anticipated notice of proposed rulemaking for a cyber incident response rule (the Proposed Rule). The Proposed Rule is scheduled to be published to the Federal Register on April 4, 2024.

Under the Proposed Rule, a broad range of "covered entities" would be required to report significant cyber incidents within 72 hours of discovery, report ransom payments within 24 hours, and retain material relevant to making the report. The Proposed Rule authorizes CISA to compel information disclosure by covered entities it suspects failed to report a cyber incident or made a ransom payment.