CIRCIA

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) is a US federal law that requires critical infrastructure organizations to report certain cyber incidents and ransomware payments to the Cybersecurity and Infrastructure Security Agency (CISA). The law was signed into effect by President Biden in March 2022 and is currently in the rulemaking process.

CIRCIA covers a wide range of critical infrastructure sectors, including energy, finance, transportation, healthcare, and communications. Covered entities are required to report certain cyber incidents within 72 hours of having a reasonable belief that the incident has occurred, and ransomware payments within 24 hours of making the payment.

CISA will use the information reported under CIRCIA to improve its understanding of cyber threats and vulnerabilities, develop and implement mitigation strategies, and coordinate with other federal agencies and critical infrastructure organizations to respond to cyber incidents.

CIRCIA is a significant step forward in improving the cybersecurity of critical infrastructure in the United States. By requiring covered entities to report cyber incidents and ransomware payments, CIRCIA will give CISA the information it needs to better protect critical infrastructure from cyberattacks.

Here are some of the benefits of CIRCIA:

• Improved situational awareness: CISA will have a better understanding of the cyber threats and vulnerabilities facing critical infrastructure by receiving timely reports from covered entities.
• Earlier detection and response: CISA can use the information reported under CIRCIA to identify and respond to cyber incidents more quickly.
• Enhanced coordination: CISA can coordinate more effectively with other federal agencies and critical infrastructure organizations to respond to cyber incidents.
• Increased deterrence: CIRCIA may deter cyberattacks by making it more difficult for cybercriminals to conceal their activities.

CIRCIA is still in the rulemaking process, but it is expected to go into effect in 2024. Once it is in effect, it will be a valuable tool for improving the cybersecurity of critical infrastructure in the United States.

The following entities must adhere to CIRCIA:

• Entities that own or operate critical infrastructure in the following sectors:
  • Energy
  • Finance
  • Healthcare
  • Transportation
  • Water and wastewater systems
  • Defense industrial base
  • Communications
  • Food and agriculture
  • Government facilities
  • Information technology
  • Manufacturing
  • Professional and business services
• Entities that provide critical services to critical infrastructure, such as:
  • Cloud computing providers
  • Cybersecurity companies
  • Managed service providers
  • Software vendors
  • System integrators

The Cybersecurity and Infrastructure Security Agency (CISA) maintains a list of critical infrastructure sectors and subsectors, which is updated periodically.

CIRCIA applies to both public and private entities. It is important to note that even if an entity is not directly listed in the law, it may still be covered by CIRCIA if it provides critical services to critical infrastructure.

CIRCIA 72 hours refers to the requirement for covered entities to report certain cyber incidents to the Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours of having a reasonable belief that the incident has occurred.

The specific cyber incidents that must be reported under CIRCIA are still being defined by CISA, but they are expected to include incidents that pose a significant risk to critical infrastructure.

Covered entities that fail to comply with the 72-hour reporting requirement may face civil penalties of up to $1 million per incident.

The 72-hour reporting requirement is intended to give CISA timely information about cyber incidents so that it can take steps to mitigate the risks to critical infrastructure and coordinate with other federal agencies and critical infrastructure organizations to respond to the incidents.

It is important to note that the 72-hour reporting requirement is not limited to ransomware attacks. Covered entities must also report other types of cyber incidents that pose a significant risk to critical infrastructure, such as denial-of-service attacks, data breaches, and supply chain attacks.

Covered entities should develop a plan for complying with the CIRCIA 72-hour reporting requirement in advance of the law going into effect. This plan should include procedures for identifying and reporting cyber incidents, as well as for documenting the steps that are taken to mitigate the risks to critical infrastructure.

CIRCIA is important because it will give CISA the information it needs to better protect critical infrastructure from cyberattacks. By requiring covered entities to report cyber incidents and ransomware payments, CIRCIA will help CISA to:

• Improve its understanding of cyber threats and vulnerabilities: CISA will be able to collect data on the types of cyber incidents that are occurring, the methods that attackers are using, and the sectors and subsectors that are most at risk. This information will help CISA to develop more effective mitigation strategies.
• Earlier detection and response: CISA will be able to identify and respond to cyber incidents more quickly by receiving timely reports from covered entities. This will help to minimize the damage caused by cyberattacks.
• Enhanced coordination: CISA will be able to coordinate more effectively with other federal agencies and critical infrastructure organizations to respond to cyber incidents. This will help to ensure that all stakeholders are working together to protect critical infrastructure.
• Increased deterrence: CIRCIA may deter cyberattacks by making it more difficult for cybercriminals to conceal their activities. If cybercriminals know that they are likely to be caught and punished, they may be less likely to attack critical infrastructure.

Overall, CIRCIA is an important step forward in improving the cybersecurity of critical infrastructure in the United States. By giving CISA the information it needs to better understand, detect, respond to, and deter cyberattacks, CIRCIA will help to protect critical infrastructure and the American people.