As covered here at CPW, President Biden recently signed into law the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (the “Act”). While the Act presents a plethora of issues for litigators and compliance professionals to consider, CPW has identified five key points that businesses should know about the Act:
Many Critical Ambiguities Are Left to CISA Rulemaking, and the Act Is not Effective Until CISA’s Final Rule
Key terms in the Act—including (i) which “covered entities” must report cyber incident and ransom payments to the Cybersecurity and Infrastructure Security Agency (“CISA”), (ii) which cyber incidents are “covered cyber incidents” triggering the reporting requirement, and (iii) which data must be preserved as “relevant” to a cyber incident or ransom payment—are explicitly left for CISA to define through rulemaking. See new § 2242(c)(1)–(2), (6). The Act establishes two deadlines for CISA’s rulemaking: CISA has 24 months after enactment to issue a proposed rule, and CISA has 18 months after the proposed rule to issue the final rule. § 2242(b). However, the Act does not provide a minimum amount of time before CISA issues either the proposed or final rule, so some clarity on critical definitions may come much sooner. The final rule will be key not only for its clarification of key terms, but because the effective date of the Act’s reporting requirements will be prescribed in the final rule. § 2242(a)(7).
The 72-Hour Clock for Cyber Incident...
NEW HAVEN — A New Haven man pleaded guilty Friday to making false claims to the IRS after he was accused of fraudulently obtaining nearly $257,000 in COVID-19 relief funds, federal prosecutors sai...