CISA's New Proposed Cyber Incident Reporting Rule: Covered Entities, Enforcement, Exceptions, Penalties

On Mar. 15, 2022, the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) was signed into law. On Apr. 4, 2024, CISA published a comprehensive proposed rule for implementing CIRCIA's requirements.

The proposed rule applies to a wide range of companies that fall into either of two categories: (1) entities operating in critical infrastructure sectors, except for small businesses as defined by the Small Business Administration; or (2) entities operating in critical infrastructure sectors that fulfill sector-based criteria, even if the entity is a small business. The critical infrastructure sectors generally include defense industries, communications, energy, food and agriculture, financial services, information technology, transportation, government facilities, and healthcare.

Under the proposed rule, covered entities must report "substantial" cyber incidents, which include events that result in a substantial loss of confidentiality, integrity, or availability of a covered entity's information system or network; have a serious impact on the safety and resilience of a covered entity's operational systems and processes; a disruption of a covered entity's ability to engage in business or industrial operations or deliver goods or services; and unauthorized access to a covered entity's information system, network, or nonpublic information.

Listen as Harley Geiger, an experienced cybersecurity law and policy attorney, summarizes the key aspects of the proposed new rule and provides guidance for advising clients on revising or developing security programs and cyber incident response strategies to meet the rule's requirements.