CISA: Cyber Incident Reporting

On April 4, 2024, the Cybersecurity and Infrastructure Security Agency (CISA) published a notice of proposed rulemaking to implement cyber incident and ransom payment reporting requirements adopted in the Cyber Incident Reporting for Critical Infrastructure Act of 2022, which requires covered entities to report cyber incidents within 72 hours after the covered entity reasonably believes that the covered cyber incident has occurred and ransom payments made in response to a ransomware attack within 24 hours after the ransom payment has been made.