Cybersecurity
CISA seeks 24-hour timeline for cyber incident reporting
The Biden administration favors a 24-hour timeline for cyber incident reporting for critical infrastructure operators and other key entities.
Brandon Wales, the executive director of the Cybersecurity and Infrastructure Security Agency, noted that Colonial Pipeline had notified customers "well in advance of 24 hours" that it was shutting down pipelines after the hack of its business systems in May.
"We do think that 24 hours is a good metric," Wales said during a live interview at Bloomberg's Policy Blueprint event on Tuesday.
That stance aligns the administration with a bipartisan cybersecurity bill offered by leaders of the Senate Select Intelligence Committee in July.
The Cyber Incident Notification Act of 2021, sponsored by Sens. Mark Warner (D-Va.), Marco Rubio (R-Fla.) and Susan Collins (R-Maine) requires covered entities to report breaches within 24 hours and sets up a new reporting system with classified capabilities to support the timely notification of cybersecurity incidents – especially those traceable to known state-sponsored threat groups – to CISA.
Separately, the leaders of the Homeland Security and Government Affairs Committee introduced the Cyber Incident Reporting Act of 2021, which sets a 72-hour deadline for a broad swath of companies to report "major incidents" to CISA. That bill passed committee, and Sen. Gary Peters (D-Mich.), a lead sponsor of the bill and the panel's chairman, said at a recent markup that he hopes to pass cyber reporting and a related update to the Federal Information Security Modernization Act in the must-pass National Defense Authorization Act.
In Senate testimony last month, CISA Director Jen Easterly said it was "long past time to get cyber incident reporting legislation out there." She also said that she favored fines as way to enforce compliance with an incident reporting regime.
"I do think a compliance and enforcement mechanism is very important here," Easterly said. "I know some of the language talks about subpoena authority. My personal view is that is not an agile enough mechanism to allow us to get the information that we need to share it as rapidly as possible to prevent other potential victims from threat actors. So I think that we should look at fines."
Industry has typically favored the longer reporting timeline. The technology trade group ITI recommends that government "allow for at least a 72-hour reporting window after an entity has verified an incident."
About the Author
Adam Mazmanian is executive editor of FCW.
Before joining the editing team, Mazmanian was an FCW staff writer covering Congress, government-wide technology policy and the Department of Veterans Affairs. Prior to joining FCW, Mazmanian was technology correspondent for National Journal and served in a variety of editorial roles at B2B news service SmartBrief. Mazmanian has contributed reviews and articles to the Washington Post, the Washington City Paper, Newsday, New York Press, Architect Magazine and other publications.
Click here for previous articles by Mazmanian. Connect with him on Twitter at @thisismaz.
"Hour" - Google News
October 20, 2021 at 12:38AM
https://ift.tt/3jgr6CD
CISA seeks 24-hour timeline for cyber incident reporting - FCW.com
"Hour" - Google News
https://ift.tt/2WcHWWo
https://ift.tt/2Stbv5k
Bagikan Berita Ini
0 Response to "CISA seeks 24-hour timeline for cyber incident reporting - FCW.com"
Post a Comment