CISA Releases Proposed Cyber Incident And Ransom Payment Reporting Rules To Implement CIRCIA

CISA's proposed rules will require organizations operating in U.S. critical infrastructure sectors to report cyber incidents within 72 hours and ransom payments within 24 hours.

On March 27, 2024, the Cybersecurity and Infrastructure Security Agency ("CISA") of the Department of Homeland Security ("DHS") announced its Notice of Proposed Rulemaking (the "Proposed Rule") to implement the Cyber Incident Reporting for Critical Infrastructure Act of 2022 ("CIRCIA"). The Proposed Rule will mandate critical infrastructure entities to report "substantial" cyber incidents and ransom payments. If adopted in its current form, the Proposed Rule would be one of the most sweeping federal cybersecurity incident-reporting regulations.