As I’ve mentioned previously, there are 16 critical infrastructure sectors in the United States. If they’re breached, we’re in trouble. So the government has been working on regulations to govern critical infrastructure cybersecurity reporting by the 316,000 covered entities.
But it’s been a long haul.
Especially since the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) was passed in 2022, and we haven’t seen any reporting per se yet.
As you probably know, passage of legislation doesn’t mean anything, because the federal executive department agencies need to translate the law into more specific regulations.
And that’s still a work in progress for CIRCIA. The first draft of the new rules was published in 2024, but hasn’t been finaliced. There was a target date of October 2025, but it wasn’t met. Then a target date of May 2026 wasn’t met. Now the target date is in September; we’ll see.
So what will the new regulations possibly entail? In addition to 72-hour incident and 24-hour ransom-payment reporting, look for these:
“Under the proposed rule, covered entities would be required to retain records and information related to reported incidents for two years, including technical evidence, logs, communications, and any other information associated with the incidents.
“While these changes introduced new requirements for covered entities, CIRCIA will also shield submitted reports from Freedom of Information Act (FOIA) disclosure and from being used as evidence in enforcement actions – unless they waive these privileges.”
Now there are pros and cons to this. Yes, prevention of FOIA disclosure will prevent concerned citizens from knowing about vulnerabilities…but it will also prevent the fraudsters from going straight to the government for handy cybercrime tips.
Now we’ll see when the regulations actually roll out.