CIRCIA 2022 Codifies Cybersecurity Incident Reporting to CISA

Since the passage of the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) the Cybersecurity and Infrastructure Security Agency (CISA) has been busy to define the rules the which will apply to the law.  Requirements in the law apply to those critical infrastructure owners’ and operators’ responsibilities to report cybersecurity incidents as well as payments in response to ransomware attacks.  The law also specifies processes for Federal agencies information reporting and sharing with CISA.  While the law is aimed at the critical infrastructure, the premise of recognizing a cybersecurity incident event applies to any organization where both Information and Operations Technology architecture is vulnerable to attacks by threat actors.  Mangan Cybersecurity’s Industrial Control Systems Secure by Design (ICSSbD^TM) Toolkit can measure the cybersecurity risk and specify controls and countermeasures for these threats. The CIRCIA rulemaking process will determine what constitutes a reportable incident.  Until then, CISA requests that critical infrastructure organizations continue to use the CISA reporting forms to share information pertaining to cybersecurity events.  (refer to Sharing Cyber Event Information With CISA: Observe, Act, Report)