A very important read for cyber security and Critical National Infrastructure (CNI) in the US.

← Back to Blog

A very important read for cyber security and Critical National Infrastructure (CNI) in the US. The US president signed into law the ‘2022 Consolidated Appropriations Act’ containing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (the Cyber Incident Reporting Act”). 

The Act focuses upon a number of broader issues. But it puts into motion important new cybersecurity reporting requirements, that will likely apply to businesses in almost every major sector of the economy, including health care, financial services, energy, transportation and commercial facilities.

Requiring CNI companies to
1. Report cyber incidents to CISA in under 72 hours. (See DoJ Civil cyber fraud initiative)
2. If a covered entity makes a ransomware payment it must be reported to CISA in under 24 hours. (See DoT ransomware under OFAC)
3. The Covered entity must keep CISA informed of the incident if substantial new or different information becomes available” or if the covered entity makes a ransom payment after submitting a covered cyber incident report.
4. Finally, they must preserve data relevant to the incident or ransomware payment. (See 1, 2)

The Act places the onus on covered entities and their board to report cyber incidents to federal Government. It may provide a trigger, with both the DoJ and DoT actively focusing on cybersecurity and the recent proposal by the SEC to implement Cybersecurity risk management for their covered entities.

The role of cybersecurity once the preserve of technology and control programs is moving to an enterprise wide risk, regulatory and compliance capability and function.

Ted Dziekanowski

#cybersecuirty #cisa #dhs #cyberrisk #cyberriskmanagement #incidentresponse #fisma

View Original Post
https://www.linkedin.com/feed/update/urn%3Ali%3Ashare%3A6910875636412612608