Cyber Incident Reporting for Critical Infrastructure Act

April 20, 2022

• The U.S. Federal Government recently passed an act requiring organizations that have experienced a cybersecurity incident to report it to the Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours. Additionally, ransomware payments must be reported in 24 hours.
• The act gives legal and regulatory protections to organizations that report the incident or payment.
• The director of CISA has subpoena power for non-compliance.

What Is the Cyber Incident Reporting for Critical Infrastructure Act of 2022 and Why Is It Important?

Cybersecurity incidents are growing in cost and scale, often affecting multiple nations and industry sectors. Historically, malicious actors could rely on a culture of secrecy within breached organizations, which might decline to disclose a breach to the Federal Government, often aiming to reduce reputational damage and legal liabilities. This sometimes came at the cost of collective security for an industry (or even a nation) because other organizations and law enforcement couldn’t prepare for or track the attacker’s movements and techniques. This constantly put both private and public sectors at a disadvantage and allowed the threat actors an easy way to expand their attacks.

In recent years, the paradigm has shifted, with more organizations now understanding the importance of sharing incident information when possible. A large drawback has been the lack of clear requirements and legal protections from the Federal Government. This has left many businesses needing to balance a collaborative approach to security with potential legal liability.

To combat this conflict, the Federal Government on March 15^th enacted the Cyber Incident Reporting for Critical Infrastructure Act of 2022 as part of the Consolidated Appropriations Act, 2022 (Public Law No: 117-103). At its core, the new law aims to require disclosure of incidents and ransomware payments to the Cybersecurity and Infrastructure Security Agency (CISA) within a predetermined amount of time. In exchange for reporting requirements, organizations will be granted some legal protections from lawsuits pertraining to the reported incident. The Federal Government’s intent with this legislation is to build a collective understanding of how threat actors are targeting organizations and critical infrastructure. With this information, CISA plans to rapidly deploy resources, render assistance and warn other potential victims.

While this act has been signed into law, the reporting requirements aren’t currently in effect. CISA is required to submit a final rule no later than 24 months from the March 15^th, 2022 enactment.

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 can be understood in three categories: requirements, protections, and enforcement.

Optiv’s Perspective On Enhancing Your Cybersecurity Program Cybersecurity activities continue to be top of mind across industries. With high profile cybersecurity attacks in the private and public sectors, we’ve seen an increasing appetite for security-related actions from congress and federal agencies. These have focused not only on federal agencies themselves but also on the private sector, whether it be a government contractor or an important link in the supply chain. This highlights the need to build out a robust, secure, and mature cybersecurity program that will help reduce exposure to cybersecurity incidents and risk to your business.

The reporting requirement encourages organizations to build a security capability to prevent or deter incidents, even if not explicitly required by the legislation. The act emphasizes accountability for incidents, including subsequent reporting until remediation. While the details of the final rule may vary slightly, the principles of risk management, governance, resilience, and attention to third parties are best practice areas that can strengthen cybersecurity programs and must not be ignored.

The time to act is now. Starting a programmatic approach today will drive readiness success when the disclosure requirements are implemented. An approach that incorporates playbooks and coordination for media, legal, and other responses will help reduce revenue and business risk, not only just cyber risk. Building and maturing a robust cybersecurity program, that reduces risk, takes time and a holistic approach. Waiting to start could require organizations to play catch-up or could potentially expose them to a greater level of legal or regulatory risk. This approach should start now and could include:

As the trusted cybersecurity partner for many leading organizations, our goal is to quickly highlight these elements to drive awareness and promote cybersecurity across the enterprise. With these requirements impacting reporting, there has never been a more important time to elevate the cybersecurity conversation within your organization.

If you have questions about how the Cyber Incident Reporting for Critical Infrastructure Act affects your organization, please drop us a line.