On March 15, 2022, President Biden signed into law the 2022 Consolidated Appropriations Act containing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (the “Cyber Incident Reporting Act”). While President Biden’s remarks highlighted the $13.6 billion in funding “to address Russia’s invasion of Ukraine and the impact on surrounding countries,” the 2022 Consolidated Appropriations Act contained numerous other laws, including the Cyber Incident Reporting Act, which should not be overlooked. The Cyber Incident Reporting Act puts in motion important new cybersecurity reporting requirements that will likely apply to businesses in almost every major sector of the economy, including health care, financial services, energy, transportation and commercial facilities. Critical infrastructure entities should monitor the upcoming rule-making by the Cybersecurity and Infrastructure Security Agency (“CISA”), as the final regulations will clarify the scope and application of the new law.

Reporting Requirements

The Cyber Incident Reporting Act imposes four primary reporting and related requirements on “covered entities” in the event of a “covered cyber incident” or a ransomware payment. Covered entities are defined by reference to Presidential Policy Directive 21, setting forth 16 critical infrastructure industries.

First, a covered entity that experiences a “covered cyber incident” must report that incident to CISA no later than 72 hours after the covered entity reasonably believes that the covered cyber incident occurred. A “covered cyber incident” means an “occurrence” that actually “jeopardizes, without lawful authority, the integrity, confidentiality, or availability of” information on an information system or that information system, which is “substantial” and satisfies criteria to be established through future rule-making. The meaning of “substantial” will be subject to future rule-making by CISA, as will the precise contents of what must disclosed in such a report, although the law provides that the following shall be included:

  • Identification and a description of the function of the affected information systems, networks that were, or are reasonably believed to have been affected by such cyber incident;
  • A description of the unauthorized access with substantial loss of confidentiality, integrity, or availability of the affected information systems or network or disruption of business or industrial operations;
  • The estimated date range of such incident; and
  • The impact to the operations of the covered entity.[1]

Second, a covered entity that makes a ransom payment as the result of a ransomware attack against the covered entity must report the payment to CISA not later than 24 hours after the ransom payment has been made. A “ransomware attack” is defined as an incident that includes “the use or threat of use of unauthorized or malicious code on an information system, or the use or threat of use of another digital mechanism such as a denial of service attack, to interrupt or disrupt the operations of an information system or compromise the confidentiality, availability, or integrity of electronic data stored on, processed by, or transiting an information system to extort a demand for ransom payment.”[2] Notably, this shorter 24 hour reporting requirement applies even if the ransomware attack does not meet the definition of a “covered cyber incident.” CISA will provide clarity as to the contents of such a report in subsequent rulemaking.

Third, a covered entity must “promptly” submit to CISA an update or supplement to a previously submitted covered cyber incident report if “substantial new or different information becomes available” or if the covered entity makes a ransom payment after submitting a covered cyber incident report. This ongoing supplemental reporting requirement remains in effect until the covered entity notifies CISA that the incident has concluded.

Fourth, a covered entity must preserve data relevant to the covered cyber incident or ransom payment.

Covered Entities and Application to the Health Care and Other Industries

The Cyber Incident Reporting Act calls for CISA to define “covered entity” in future rulemaking from among entities in a critical infrastructure sector, as defined in Presidential Policy Directive 21.  Presidential Policy Directive 21 identifies sixteen critical infrastructure sectors, including “Healthcare and “Public Health” as well as sectors covering broad segments of business such as “Commercial Facilities,” “Communications,” “Financial Services,” “Critical Manufacturing,” “Energy,” “Information Technology,” and “Transportation Systems” among others.

As “Healthcare and Public Heath” is an identified critical infrastructure sector, health care entities should anticipate being subject to the Cyber Incident Reporting Act as “covered entities” (which is not identical to the term as defined under the Health Insurance Portability and Accountability Act (“HIPAA”)). The Cyber Incident Reporting Act contains an exception to the reporting requirement for covered entities “required by law, regulation, or contract to report substantially similar information to another Federal agency within a substantially similar timeframe” and provided that the Federal agency receiving such reports has an agreement in place to share such information with CISA. As HIPAA does not require reporting of covered cybersecurity incidents or ransomware payments as defined under the Act to any Federal agency, HIPAA covered entities are not excepted from the reporting requirements of the Cyber Incident Reporting Act at this time.

It should be noted also that the definition of “cyber incident” does not require that protected health information be involved in the incident. Thus, a HIPAA covered entity could suffer a reportable cyber incident that is not a “breach” or “security incident” under HIPAA. In addition, the Cyber Incident Reporting Act has short 24 or 72 hour windows for reporting, in comparison to the longer time periods for reporting a breach of protected health information prescribed by the HIPAA breach notification rule.

Similarly, while we await the final rulemaking, further clarification and potential agency sharing agreements, other critical infrastructure entities should anticipate being subject to the reporting and data preservation requirements. This rule will significantly broaden existing breach reporting and incident response requirements for many organizations, and goes well beyond breach notification laws that are limited by data type as the reporting requirements extend here to all information and information systems held by the covered entity. The Act also expressly recognizes that businesses may need assistance of third party cybersecurity expertise in fulfilling their obligations, including providing that law firms and incident responders may submit the reports on their behalf.

Effective Date

The reporting requirements of the Cyber Incident Report Act will not go into effect until the final rules are promulgated under the Act. Presently, the law directs CISA, together with the Department of Justice and other federal agencies, to publish a notice of proposed rule-making within 24 months of the date of the enactment of the law, and that a final rule should be issued by CISA no later than 18 months after publication of the proposed rule-making.

Any questions regarding these emerging issues may be directed to Allen Killworth, Brian G. Cesaratto, CISSP, CEH, and Alexander Franchilli, CIPP/US.

*****************************************

[1] Sec. 2242(b)(4).

[2] Sec. 2240(d)

Back to Workforce Bulletin Blog

Search This Blog

Blog Editors

Authors

Related Services

Topics

Archives

Jump to Page

Subscribe

Sign up to receive an email notification when new Workforce Bulletin posts are published:

Privacy Preference Center

When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer.

Strictly Necessary Cookies

These cookies are necessary for the website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

Performance Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. All information these cookies collect is aggregated and therefore anonymous. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.