New Law Requires 72-Hour Notice For Cyber Incidents

Background

President Biden has recently delivered on a long stated priority of his presidency: requiring the disclosure of cyber security incidents for companies that operate critical infrastructure. After announcing an executive order in May 2021 aimed at modernizing the federal government's cybersecurity practices, the same sweeping changes will now effect private companies that operate critical infrastructure. At the time of the executive order, some noted that the recent string of high profile ransomware attacks was leading to a bipartisan effort to require disclosures of such incidents by those effected in the private sector. Indeed, Congress has acted quickly in codifying disclosure requirements for those that operate critical infrastructure.