CISA must publish cyber incident reporting to enact the Cyber Incident Reporting for Critical Infrastructure Act, and address the historic voluntary

← Back to Blog

CISA must publish cyber incident reporting to enact the Cyber Incident Reporting for Critical Infrastructure Act, and address the historic voluntary approach taken for cyber incident declarations. But industry has been pushing back, raising concerns about declaring sensitive incident information and citing the affects of providing incident data on their continued security.

But this isn’t the problem and one would ague along with the enclosed article, the problem is much bigger and not just one of ignorance. U.S and EU regulators are looking to adopt cybersecurity risk management regulations ‘left of bang’. The bigger issue is how will CNI (and other) providers adopt basic cybersecurity risk management practices including assessments and control regimes to manage the risk?

Cyber incident reporting is important in providing data on incidents, helping prevent their spread and if CISA lowers the threshold of reporting, as suggested, enable a more accurate picture of the problem.

But prevention is so much better than cure, and in the long run is more effective.

Ted Dziekanowski
Gerry Kennedy

#cybersecurity #cyberinsurance #cyberriskmanagement #cyberlaw #cyberregulation #theaugustagroup

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6995297024149442560