Cyberattacks on more than a hundred critical infrastructure sectors must now inform within hours of their breakthrough. In light of a new warning issued this week about a rise in possible Russia-backed cyberattacks against private U.S. companies, will the federal government extend those reporting standards to more private organizations?
Recently, President Joe Biden signed a budget bill into law. That bill supports the Cyber Incident Reporting for Critical Infrastructure Act, a component of the Strengthening American Cybersecurity Act of 2022.
It requires operators to notify the Cybersecurity & Infrastructure Security Agency (CISA) of a cyberattack in less than 72 hours. Also, make a ransomware deposit within 24 hours.
Right now, these reporting requirements only apply to the 16 main infrastructure areas recognized in Presidential Policy Directive 21 (PPD-21). It includes government and health care facilities, transportation, power, and water supply systems.
Why Is This Law A Game Changer?
The head of the cybersecurity strategy suggests that the new is a game-changer. According to him, the government’s choice to finally remove the plausible deniability that had occurred for a time is a fundamentally crucial strategic decision.
He stated that the businesses have been underinvesting in cybersecurity. The new law will compel companies to hire a chief information security officer (CISO), give that person a financial plan, and oversee detection response.
What Does The New Law Provide?
CISA now is in authority to issue summons to organizations that fail to report any cybersecurity incidents under the new law. Refusal to cooperate with the subpoena can result in a referral to the Department of Justice.
The provision requires the CISA to launch a program to alert organizations to vulnerabilities exploited by ransomware actors. It informs the CISA Director. The Director then develops a joint ransomware investigation team to prevent ransomware attacks.
The latest omnibus bill permits $2.59 billion in CISA support, $300 million more than the Biden administration proposed.
Centralized Repository By CISA
He points out that CISA will have a centralized repository of threat-actor plans, programs, and operations. Thus this will facilitate information sharing among relevant agencies such as the Department of Justice and the FBI, which will provide a standardized method for dealing with these attacks, prosecuting potential cybercriminals, and ensuring that every reporting entity has a clearly defined cybersecurity strategy.
According to Davis McCarthy, who is said to be the principal security researcher at Valtix, the law is a cooperative effort by the federal government to fight the thriving cybercrime industry.
Rogue Logics provides in-depth security services for the assessment and protection of your application, data, and infrastructure against potential threats on-prem or in the cloud.
Want a consultation with the professionals at Rogue Logics? Contact us and get a free quote.