Imagine That IP Law Blog

As the threat of cyberattacks looms in the wake of the U.S.’s response to Russia’s invasion of Ukraine, President Biden signed into law a $1.5 trillion spending package on March 11, 2022 that funds the federal government through the fall. The law includes the strongest cybersecurity legislation in recent history and adopts the Strengthening American Cybersecurity Act of 2022. Jen Easterly, director of the Cybersecurity and Infrastructure Security Agency (“CISA”), stated, “Put plainly, this legislation is a game changer.”

The law increases funding for CISA over 22% from last year, adding $568.7 million for a total allocation of $2.6 billion. The bolstered budget indicates the urgency to prevent cyberattacks and protect critical infrastructure and communications systems.

The legislation imposes mandatory reporting on certain critical infrastructure companies, like those dealing in oil, banking, transportation, and electricity. CISA’s guidance on Essential Critical Infrastructure is found here. These entities will be required to report covered cybersecurity incidents to CISA within 72 hours of a cyberattack and within 24 hours of a ransomware payment. CISA, in turn, must report to the appropriate federal agencies within 24 hours.

Reporting requirements have been supported by security experts following recent attacks on supply chains, as in the SolarWinds breach, and ransomware attacks on critical infrastructure providers, like the recent Colonial Pipeline shutdown. Mandated reporting of cyberattacks allows federal authorities to warn others, to understand how hackers target U.S. infrastructure and spot trends in cyberactivity, to fill information gaps, to prepare for widespread impact, and to allow CISA to render assistance to affected companies.

Historically, the Department of Homeland Security, which oversees CISA, has preferred to partner with critical infrastructure providers to address cyber incidents, rather than mandate reporting and punish for non-compliance. However, Senator Mark Warner, chair of the Senate Intelligence Committee, indicated during a hearing last week that the private sector only informs government agencies of about 30% of cyberbreaches. The recently passed legislation signals a reversal in DHS’s policy.

Critical infrastructure companies avoid notifying federal agencies for many reasons. Such disclosure would increase the risk of potential litigation from investors, potentially damage a brand, and open the company to law enforcement probes. To address these concerns, the legislation provides broad protection for submitted reports, including: protecting covered entities from liabilities for providing information to the federal government; limiting the use of reports by the government; treating reports as proprietary information; exempting reports from FOIA requests and other disclosure laws; and prohibiting ransomware payments from being used to regulate the infrastructure companies.

Fortunately for covered entities, the specifics of the law are subject to subsequent rulemaking by CISA and proposals and comments from a wide variety of industries will be incorporated into the final version of the law. CISA has 24 months to propose parameters for the new rules, including how to determine which entities are covered, what must be reported, and what information is needed to complete a report. CISA will then have 18 months to finalize the rules.

Although there is significant lead time before the implementation of any regulations, given the current global uncertainties, it is conceivable that the timeline could be sped up to address the urgency of strong cyber protection.  Companies that are or may be covered by the new law should continue to monitor the regulatory process and begin assessing what actions may be necessary to comply with the law and regulations.