Strengthening Cybersecurity Notification Requirements

Last week, the U.S. Senate passed S. 3600, the Strengthening American Cybersecurity Act, which represents a significant step forward in the establishment of a national data breach notification law for certain critical infrastructure businesses and marks, for the first time, that businesses will be required to report when they have made ransomware payments.

Here are five key takeaways from the bill:

• Under the bill, a "covered entity" will be required to report certain cyber incidents they experience to the Cybersecurity and Infrastructure Security Agency ("CISA") within 72 hours of when the "covered entity reasonably believes that the covered cyber incident has occurred," and any ransom payments they make as a result of a ransomware attack not later than 24 hours after the payment has been made.