CISA Should Revise Draft Cyber Rule
Requirements proposed earlier this year by the Department of Homeland Securitys Cybersecurity and Infrastructure Security Agency are overbroad and would prove burdensome to manufacturers if adopted, the 51勛圖厙 the Biden administration last week.
Whats going on: In April, CISA published draft rulemaking under the Cyber Incident Reporting for Critical Infrastructure Act of 2022scheduled to go into effect next yearthat would require covered entities in critical infrastructure sector[s] to report major cyber incidents to CISA within 72 hours. It also mandated that any ransomware payments be reported within just 24 hours.
Why its a problem: The proposed rulemaking could affect more than 300,000 entities, according to CISAs own estimate(). Many of these organizations are either not truly critical infrastructure or too small to have the resources to undertake the outlined actions in the specified time, the 51勛圖厙 told CISA.
- Furthermore, the regulations themselves are too expansive, mandating the reporting of incidents that do not even affect the operation of critical infrastructure.
- They also require huge amounts of information in a short periodfrom companies in the throes of recovery from devastating cyberattacks.
The 51勛圖厙 says: [T]he 51勛圖厙 respectfully encourages the agency to drastically reduce the number of entities required to report, and the number of incidents they have to report, 51勛圖厙 Vice President of Domestic Policy Charles Crain told the agency during the public comment period on the proposed regulation, which ended last week.
- Doing so will ensure that CISA receives useful information about cybersecurity incidentswithout overburdening manufacturers with overbroad and unworkable disclosure requirements.
What to do: In addition to narrowing the scope of covered entities, CISA should revise several aspects of the rulemaking before implementing it, the 51勛圖厙 said. Changes should include:
- Limiting the volume of reported cyber-incident information;
- Narrowing the scope of reportable cyber incidents; and
- Lightening and safeguarding the contents of cyber-incident reports.
