On April 4, 2024, the Department of Homeland Security’s (DHS) Cybersecurity and Infrastructure Security Agency (CISA) officially published its Notice of Proposed Rulemaking (NPRM) detailing significant new cybersecurity reporting requirements. These proposed requirements, which were open for public comment until June 3, 2024, aim to enhance national cybersecurity by ensuring timely reporting and response to cyber threats.
Key rules include:
- Cyber Incident Reporting:
- Requires covered entities to report cyber incidents to CISA within 72 hours of identification.
- Federal entities must share received incident reports with CISA within 24 hours.
- Ransomware Initiatives:
- Entities must report ransom payments to CISA within 24 hours.
- Establishes a Ransomware Vulnerability Warning Pilot Program and a Joint Ransomware Task Force.
- Voluntary Reporting Encouraged:
- Organizations are urged to share cyber incident data with CISA during the rulemaking period to assist in trend analysis and national security efforts.
The rules define a “covered cyber incident” as one that leads to substantial loss of confidentiality, integrity, or availability of an information system or network, or disrupts business or industrial operations. These requirements apply to a broad range of critical infrastructure sectors, including energy, healthcare, and finance.
The proposed rules also outline the specific information that must be included in these reports, such as the nature and impact of the incident, the vulnerabilities exploited, and the actors involved. CISA intends to use this information to coordinate responses to cyber threats and share anonymized data with other critical infrastructure entities to bolster overall cybersecurity resilience.
The rules also provide CISA several mechanisms for enforcing regulations, including: (i) issuing a request for information (RFI); (ii) issuing a subpoena; (iii) referral to the Attorney General for a civil action.