Cybersecurity Incident Reporting for Critical Infrastructure Act: Reporting Timeframes, Liability Protection, Enforcement

Description

CIRCIA, passed as part of the omnibus spending bill on Mar. 15, 2022, will require critical infrastructure companies--which could include financial services companies, energy companies, and other key businesses for which a disruption would impact economic security or public health and safety--to report any substantial cybersecurity incidents or ransom payments to the federal government within 72 and 24 hours, respectively.

CIRCIA establishes reporting requirements for entities that (1) have experienced a "covered cyber incident" and (2) meet the definition of a "covered entity." "Covered entity" is not yet fully defined, but will likely include those that belong to any of the 16 critical infrastructure sectors defined by DHS.

CIRCIA also clearly establishes the timing involved when a report must be made and includes limited liability protection for entities that report an incident to CISA.

CIRCIA does provide an exception for entities that are already required by law, regulation, or contract to report substantially similar information to another federal agency within a similar timeframe, as long as there is an agreement in place between CISA and the other agency. State breach reporting obligations and reports to European privacy regulators will likely not trigger the exception, and organizations filing such reports likely will still need to report to CISA.

Listen as our expert panel discusses all of the new obligations under CIRCIA, the best practices to mitigate risks if noncompliant, and what the likely outcome of regulation of this Act will be.