Taylor Sample Outlines CISA's Proposed Cyber Reporting Rules

Bass, Berry & Sims attorney Taylor Sample authored an article for Cybersecurity Insiders outlining the U.S. Cybersecurity & Infrastructure Security Agency's (CISA) proposed cyber reporting rules.

The public comment period for the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) closed on June 3, 2024, leaving CISA a little over a year to make any modifications and publish the Final Rule. CIRCIA was developed with an aim at responding to the growing number of cyber threats and attacks on entities operating within critical infrastructure sectors.

Taylor identified which entities must report, what qualifies as a "substantial" cyber incident, when a company must report an incident, and what a company needs to include in its reports. The information provided to CISA would then only be used by federal agencies for cybersecurity purposes, such as identifying a threat or security vulnerability or responding to specific threats involving death, bodily