May 28, 2022

Volume XII, Number 148

Advertisement
Advertisement

May 27, 2022

Subscribe to Latest Legal News and Analysis

May 26, 2022

Subscribe to Latest Legal News and Analysis

May 25, 2022

Subscribe to Latest Legal News and Analysis

U.S. Senate Unanimously Passes Cybersecurity Legislation Requiring 72 Hour Cyber Incident Notification

On March 2, 2022, the Senate unanimously passed the Strengthening American Cybersecurity Act of 2022 (“SACA” or the “Bill”). The Bill is now with the House of Representatives for a vote and, if passed, will be sent to President Biden’s desk for signature.

Introduced by Senators Rob Portman (R-OH) and Gary Peters (D-MI), the Bill uses language from three other bills: the Cyber Incident Reporting for Critical Infrastructure Act (S. 2875), the Federal Information Security Modernization Act (S. 2902) and the Federal Secure Cloud Improvement and Jobs Act (S. 3099). Notably, the Bill would require critical infrastructure operators to report “substantial cyber incidents” to the Cybersecurity and Infrastructure Security Agency (“CISA”) within 72 hours and report ransomware payment within 24 hours. The Bill also would include several other reforms intended to strengthen cybersecurity within the federal government, including:

  • requiring federal civilian agencies to report all substantial cyber incidents to CISA within 72 hours;

  • requiring certain information sharing to improve coordination between federal agencies;

  • authorizing the Federal Risk and Authorization Management Program (“FedRAMP”) for five years so that federal agencies can adopt cloud-based technologies.

The Bill also would authorize the Director of Office of Management and Budget, in consultation with Sector Risk Management Agencies, the Department of Justice and other federal agencies, to issue a regulation to implement SACA. This regulation would define and establish criteria for what constitutes a “substantial cyber incident.” It also would provide a description of the required contents of a cyber incident report or ransom payment report to CISA, building upon the requirements already listed in Sections 2242(c)(4)-(5) in the Bill.

Upon passage of the bill, Senator Peters said, “Our landmark, bipartisan bill will ensure CISA is the lead government agency responsible for helping critical infrastructure operators and civilian federal agencies respond to and recover from major network breaches and mitigate operational impacts from hacks. I will continue urging my colleagues in the House to pass this urgently needed legislation to improve public and private cybersecurity as new vulnerabilities are discovered, and ensure that the federal government can safety and securely utilize cloud-based technology to save taxpayer dollars.”

Read the Bill and track its status.

Copyright © 2022, Hunton Andrews Kurth LLP. All Rights Reserved.National Law Review, Volume XII, Number 76
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement
Advertisement

About this Author

In today’s digital economy, companies face unprecedented challenges in managing privacy and cybersecurity risks associated with the collection, use and disclosure of personal information about their customers and employees. The complex framework of global legal requirements impacting the collection, use and disclosure of personal information makes it imperative that modern businesses have a sophisticated understanding of the issues if they want to effectively compete in today’s economy.

Hunton Andrews Kurth LLP’s privacy and cybersecurity practice helps companies manage data and...

212 309 1223 direct
Advertisement
Advertisement
Advertisement