CISA’s Proposed Rule for Critical Infrastructure Cyber Incident Reporting: Analysis of Key Provisions

CISA’s Proposed Rule for Critical Infrastructure Cyber Incident Reporting: Analysis of Key Provisions

May 15, 2024, The Cybersecurity Law Report

Part one of a two-part series.

On April 4, 2024, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) published its much-anticipated Notice of Proposed Rulemaking (Proposed Rule) to implement the requirements of the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). While the Proposed Rule is subject to further rulemaking before the Final Rule is issued, it nonetheless represents what will likely be the most sweeping cybersecurity incident notification regulation in the United States to date, covering entities of various sizes across many sectors.