On March 15, 2022, President Biden signed the Consolidated Appropriations Act 2022, a $1.5 trillion omnibus spending package to fund the government through September 2022. The omnibus spending package includes the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (the "Act"), which establishes two cyber incident reporting requirements for covered critical infrastructure entities: a 24-hour requirement to report any ransomware payments to the U.S. Cybersecurity and Infrastructure Security Agency ("CISA") and a 72-hour requirement to report all covered cyber incidents to CISA. These requirements will take effect upon the issuance of implementing regulations from the Director of CISA.
Covered Entities. The Act applies to "covered entities" in the sixteen United States critical infrastructure sectors. Such covered entities will be further defined by the CISA Director through a rulemaking process described further below.
24-Hour Ransom Payment Reporting Requirement. Covered entities that make payments as "the result of a ransomware attack" (as defined by the Act) must report the payment to CISA within 24 hours of the payment. Such reports must contain specific information about the ransomware attack and the threat actors reasonably believed to be responsible for the attack including, inter alia: a description of the attack; a description of the vulnerabilities, tactics, techniques, and procedures used to perpetuate the attack; any identifying or contact information related to each actor reasonably believed to be responsible for the ransomware attack; the date and amount of the ransom payment; and the ransom payment demand and instructions.
72-Hour Cyber Incident Reporting Requirement. Covered entities are required to report any "covered cyber incident" to CISA within 72 hours and to "promptly" submit supplemental reports providing updated or additional information about the incident, including if ransom payments are made after the submission of an initial report.
Covered Cyber Incidents. The Act specifies that "covered cyber incidents" include "substantial" cyber incidents that involve: the substantial loss of confidentiality, integrity, or availability of information systems or networks or a serious impact on the safety and resiliency of operational systems and processes; a disruption of business or industrial operations, whether on an information system or network or an operational technology system or process; or unauthorized access or disruption of business or industrial operations due to loss of service facilitated through, or caused by, a compromise of a third-party provider or by a supply chain compromise.
Content of Incident Reports. The Act specifies that covered incident reports shall contain certain information about the incident and any actor reasonably believed to be responsible for the incident, including, inter alia: a description of the covered incident; a description of the vulnerabilities, security defenses, tactics, techniques, and procedures used to perpetuate the cyber incident; and the identification of the category or categories of information that were, or are reasonably believed to have been, accessed or acquired by an unauthorized person.
Preservation of Information. The Act specifies that any covered entity subject to the Act's reporting requirements shall preserve any relevant data associated with a covered cyber incident or ransom payment.
Exemption. The Act provides a reporting exemption to covered entities that are "required by law, regulation, or contract" to submit substantially similar information to another Federal agency within a substantially similar timeframe as the reporting timeframe provided in the Act.
Enforcement. If a covered entity fails to make a required report, the Act permits the CISA Director to directly engage with the entity to obtain the relevant information. If the entity fails to cooperate with such direct engagement, the CISA Director may issue a subpoena to obtain the relevant information. If an entity fails to comply with a subpoena, the matter may be referred to the U.S. Department of Justice for enforcement.
Liability Protections. The Act shields reporting entities from liability associated with the submission of incident reports required by the Act or future implementing regulations. These liability protections only apply to litigation based solely on the submission of a covered cyber incident report or ransom payment report to CISA.
Timing/Effective Date. These requirements have not yet taken effect. The CISA Director has two years to publish a notice of proposed rulemaking to implement the Act, and 18 months after that to issue the final rule. Thus, the CISA Director has up to three and a half years to issue the final rule. That said, given the U.S. Government's current level of interest in cyber incidents related to critical infrastructure, the CISA Director may move quickly to implement the requirements of the Act. In other words, although the Act provides the Director with three and a half years to issue the final rule, any such rulemaking is likely to take place prior to this statutory deadline.
Outlook. Critical infrastructure entities that believe they may be covered by the final rule may want to consider examining their internal processes to detect, identify, and respond to cyber incidents and developing a testing strategy to exercise these processes on a periodic basis. Additionally, they should consider whether they would like to engage in the rulemaking process (e.g., through the submission of comments). Further, as the rulemaking process will provide more granular requirements consistent with the Act, critical infrastructure entities that believe they may be covered by the final rule should continue to monitor developments in this area to understand the full scope of the requirements that are likely to be imposed through the rulemaking process and when those requirements are likely to take effect.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
