The New Cyber Incident Reporting Law - Implications and Issues to be aware of

U.S. Congress recently signed the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) into law. This law brings increased visibility to the scope and severity of ransomware attacks and payments. CIRCIA imposes reporting requirements on “covered entities” in the event of a ransomware payment. Covered entities are defined in the Presidential Policy Directive 21, referring to 16 critical infrastructure industries. If a covered entity makes a ransom payment after suffering a ransomware attack, the entity must report the payment to CISA in under 24 hours after the payment is made. Such knowledge allows CISA to inform the public of large scale cyber attacks in an effort to prevent potentially imminent cyber attacks. This law is consistent with the government’s views against paying the ransom because of concerns that it will further incentivize threat actors. We’ll discuss all of the implications for business during this session