CIRCIA

Who it applies to

Covered entities in critical infrastructure sectors, as defined in CISA's rule.

Key requirements

• Report covered cyber incidents to CISA.
• Report ransom payments made as a result of a ransomware attack.
• Provide supplemental reports when substantial new information becomes available.
• Preserve data relevant to the incident.

Breach and incident notification

Under the statute: covered cyber incidents within 72 hours after the entity reasonably believes one occurred, and ransom payments within 24 hours after payment, once the final rule is in effect.

Penalties

CISA can issue requests for information and subpoenas, and refer non-compliance to the Department of Justice for civil action.

Go deeper