Top Five Takeaways For Businesses From The New CISA Cyber Reporting Act

As covered here at CPW, President Biden recently signed into law the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (the "Act").  While the Act presents a plethora of issues for litigators and compliance professionals to consider, CPW has identified five key points that businesses should know about the Act:

1. Many Critical Ambiguities Are Left to CISA Rulemaking, and the Act Is not Effective Until CISA's Final Rule

Key terms in the Act—including (i) which "covered entities" must report cyber incident and ransom payments to the Cybersecurity and Infrastructure Security Agency ("CISA"), (ii) which cyber incidents are "covered cyber incidents" triggering the reporting requirement, and (iii) which data must be preserved as "relevant" to a cyber incident or ransom payment—are explicitly left for CISA to define through rulemaking.  See  new § 2242(c)(1)–(2), (6).  The Act establishes two deadlines for CISA's rulemaking: CISA has 24 months