CISA Signals Cyber Incident Reporting Requirements

In March 2022, Congress passed the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) requiring critical infrastructure to report significant cyber incidents and ransomware payments to the Cybersecurity & Infrastructure Security Agency (CISA) within tight time frames under rules to be developed. CISA has now signaled what its reporting priorities are. Here's what critical infrastructure entities should know:

What Triggers a Reporting Obligation

CISA's reporting obligations focus on the following:

1. Significant Cyber Incident:  When there is a reasonable belief that a significant cyber incident has occurred, the covered incident must be reported to CISA within 72 hours.