Introduction
On March 15, 2022, President Biden signed into law the Cyber
Incident Reporting for Critical Infrastructure Act of 2022. The Act
will require critical infrastructure organizations (defined below)
to report cyber attacks to the Cybersecurity and Infrastructure
Security Agency (CISA) within 72 hours. The Act also creates an
obligation to report ransomware payments within 24 hours.
According to the Federal Bureau of Investigation's
2021
Internet Crime Report, released on March 23, 2022, cyber
incidents rose 7% from 2020, with potential losses topping $6.9
billion. Many of the most threatened organizations fall into the
critical infrastructure sector, and in 2021 alone, cyber incidents
caused oil and food shortages, as well as supply chain threats.
With cyber incidents reaching all-time highs in 2021, the
legislation purports to protect U.S. critical infrastructure
entities and investigate cyber crimes moving forward. The Act
suggests that reporting
