{"id":3469,"date":"2022-11-18T14:44:54","date_gmt":"2022-11-18T19:44:54","guid":{"rendered":"https:\/\/www2.law.temple.edu\/10q\/?p=3469"},"modified":"2022-11-18T14:44:54","modified_gmt":"2022-11-18T19:44:54","slug":"is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements","status":"publish","type":"post","link":"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/","title":{"rendered":"Is Your Company Prepared for the New Cyber Incident Reporting Requirements?"},"content":{"rendered":"

On March 11, 2022, President Biden signed into law the\u00a0Cyber Incident Reporting for Critical Infrastructure Act of 2022<\/a>. The law includes new reporting requirements for companies who experience cyber incidents or make ransomware payments.<\/p>\n

Under the law, covered entities that experience covered cyber incidents must report the incident to the Cybersecurity and Infrastructure Security Agency (\u201cCISA\u201d) within 72 hours after the covered entity reasonably believes that a covered cyber incident has occurred. Covered entities must also notify CISA within 24 hours of making a ransomware payment.<\/p>\n

The new cyber reporting law tasks CISA with creating more precise definitions for who is considered a \u201ccovered entity\u201d and what constitutes a \u201ccyber incident.\u201d Even the general language of the statute, however, provides some guidance for companies.<\/p>\n

Is your company a covered entity?<\/strong><\/em><\/p>\n

Covered Entities.<\/strong>\u00a0In defining who qualifies as a \u201ccovered entity,\u201d Congress instructed CISA to consider three factors:<\/p>\n

(1) Whether the compromise or disruption to the entity could impact national security, economic security, or public health and safety;<\/p>\n

(2) The likelihood that such an entity may be targeted by a malicious cyber actor, including a foreign country; and<\/p>\n

(3) Whether the compromise or disruption to the entity will affect critical infrastructure.<\/p>\n

Based on these factors, we can expect organizations in the financial, healthcare, and defense industries to be subject to these reporting requirements.<\/p>\n

What qualifies as a covered cyber incident?<\/strong><\/em><\/p>\n

Covered Cyber Incident.<\/strong>\u00a0A \u201ccovered cyber incident\u201d must \u201cat a minimum\u201d include one or more of the following:<\/p>\n

(1) \u201c[S]ubstantial loss of confidentiality, integrity, or availability of such information system or network, or a serious impact on the safety and resiliency of operational systems and processes\u201d;<\/p>\n

(2) \u201c[D]isruption of business or industrial operations, . . . against an information system or network or an operational technology system or process\u201d; or<\/p>\n

(3) \u201c[U]nauthorized access or disruption of business or industrial operations due to loss of service facilitated through, or caused by, a compromise of a cloud service provider, managed service provider, or other third-party data hosting provider or by a supply chain compromise.\u201d<\/p>\n

What must be included in a cyber incident report?<\/strong><\/em><\/p>\n

Cyber Incident Report.<\/strong>\u00a0The report a covered entity submits must include the following:<\/p>\n

(1) A description of the cyber incident (e.g.<\/em>,<\/em> affected networks\/devices, description of unauthorized access, estimated date range of the incident, impact of the attack);<\/p>\n

(2) A description of the vulnerabilities exploited and security defenses that were in place;<\/p>\n

(3) Identifying information of the actors responsible for the cyber incident (to the extent available);<\/p>\n

(4) A description of the types of information that were accessed;<\/p>\n

(5) Names and identifying information of the entities that were impacted by the attack; and<\/p>\n

(6) Contact information for the covered entity.<\/p>\n

Reporting incentives and privacy issues<\/strong><\/em><\/p>\n

The law also provides several incentives for companies to report cyber incidents. For example, companies that submit a report will receive liability protection from \u201clitigation that is solely based on the submission of a covered incident report or ransom payment report.\u201d The report and document and communications created for the \u201csole purpose\u201d of preparing the report are not discoverable or admissible in other trials or hearings.<\/p>\n

The law also addresses privacy and trade secret concerns raised by the private sector. The law preserves the trade secret status of any information provided in the report and exempts the report from the Freedom of Information Act or any state or local government equivalent as well as limits the distribution of the report within the federal government.<\/p>\n

We expect more updates over the next year as CISA promulgates new rules implementing the law. In the meantime, companies should continue monitoring these developments and begin to prepare a response plan if they think the law is likely to apply to their industry.<\/p>\n

The full article in its original form can be found here<\/a>.<\/p>\n

Michael J. Montalbano (BS \u201912) is an associate in the Government Contracts practice group at Blank Rome. <\/em>
\n<\/a><\/p>\n

 <\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Michael J. Montalbano (BS \u201912) of Blank Rome wrote an article outlining the new reporting requirements derived from the Cyber Incident Reporting for Critical Infrastructure Act of 2022.<\/p>\n","protected":false},"author":33,"featured_media":3471,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[12,52,14,20],"tags":[106,1829,1628,497,1609,746,365],"coauthors":[2357],"class_list":["post-3469","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-alumni-authored","category-compliance","category-corporate-governance","category-technology","tag-compliance","tag-corporate-governance","tag-cyber-crime","tag-cyber-security","tag-infrastructure","tag-privacy","tag-technology","masonry-post","generate-columns","tablet-grid-50","mobile-grid-100","grid-parent","grid-33"],"yoast_head":"\nIs Your Company Prepared for the New Cyber Incident Reporting Requirements? - The Temple 10-Q<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Is Your Company Prepared for the New Cyber Incident Reporting Requirements? - The Temple 10-Q\" \/>\n<meta property=\"og:description\" content=\"Michael J. Montalbano (BS \u201912) of Blank Rome wrote an article outlining the new reporting requirements derived from the Cyber Incident Reporting for Critical Infrastructure Act of 2022.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/\" \/>\n<meta property=\"og:site_name\" content=\"The Temple 10-Q\" \/>\n<meta property=\"article:published_time\" content=\"2022-11-18T19:44:54+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2022\/11\/computer-g1b91f50e9_1920.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1256\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Michael J. Montalbano (BS \u201912)\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Michael J. Montalbano (BS \u201912)\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/\"},\"author\":{\"name\":\"Erica Maier\",\"@id\":\"https:\/\/law.temple.edu\/10q\/#\/schema\/person\/d88f9d6c1e573914b328a9fc287d495a\"},\"headline\":\"Is Your Company Prepared for the New Cyber Incident Reporting Requirements?\",\"datePublished\":\"2022-11-18T19:44:54+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/\"},\"wordCount\":648,\"commentCount\":0,\"image\":{\"@id\":\"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2022\/11\/computer-g1b91f50e9_1920.jpg\",\"keywords\":[\"Compliance\",\"corporate governance\",\"Cyber crime\",\"Cyber Security\",\"Infrastructure\",\"Privacy\",\"Technology\"],\"articleSection\":[\"Alumni Authored\",\"Compliance\",\"Corporate Governance\",\"Technology\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/\",\"url\":\"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/\",\"name\":\"Is Your Company Prepared for the New Cyber Incident Reporting Requirements? - The Temple 10-Q\",\"isPartOf\":{\"@id\":\"https:\/\/law.temple.edu\/10q\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2022\/11\/computer-g1b91f50e9_1920.jpg\",\"datePublished\":\"2022-11-18T19:44:54+00:00\",\"author\":{\"@id\":\"https:\/\/law.temple.edu\/10q\/#\/schema\/person\/d88f9d6c1e573914b328a9fc287d495a\"},\"breadcrumb\":{\"@id\":\"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/#primaryimage\",\"url\":\"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2022\/11\/computer-g1b91f50e9_1920.jpg\",\"contentUrl\":\"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2022\/11\/computer-g1b91f50e9_1920.jpg\",\"width\":1920,\"height\":1256},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/law.temple.edu\/10q\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Is Your Company Prepared for the New Cyber Incident Reporting Requirements?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/law.temple.edu\/10q\/#website\",\"url\":\"https:\/\/law.temple.edu\/10q\/\",\"name\":\"The Temple 10-Q\",\"description\":\"Temple's Business Law Magazine\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/law.temple.edu\/10q\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/law.temple.edu\/10q\/#\/schema\/person\/d88f9d6c1e573914b328a9fc287d495a\",\"name\":\"Erica Maier\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/287d6d70b5641c5fca2014a2642c81f4173a498c7b1d1dafac589e1a9dc74e18?s=96&d=mm&r=g5e523333d61dc7fabb86b49c5ffcbaee\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/287d6d70b5641c5fca2014a2642c81f4173a498c7b1d1dafac589e1a9dc74e18?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/287d6d70b5641c5fca2014a2642c81f4173a498c7b1d1dafac589e1a9dc74e18?s=96&d=mm&r=g\",\"caption\":\"Erica Maier\"},\"url\":\"https:\/\/law.temple.edu\/10q\/author\/emaier\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Is Your Company Prepared for the New Cyber Incident Reporting Requirements? - The Temple 10-Q","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/","og_locale":"en_US","og_type":"article","og_title":"Is Your Company Prepared for the New Cyber Incident Reporting Requirements? - The Temple 10-Q","og_description":"Michael J. Montalbano (BS \u201912) of Blank Rome wrote an article outlining the new reporting requirements derived from the Cyber Incident Reporting for Critical Infrastructure Act of 2022.","og_url":"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/","og_site_name":"The Temple 10-Q","article_published_time":"2022-11-18T19:44:54+00:00","og_image":[{"width":1920,"height":1256,"url":"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2022\/11\/computer-g1b91f50e9_1920.jpg","type":"image\/jpeg"}],"author":"Michael J. Montalbano (BS \u201912)","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Michael J. Montalbano (BS \u201912)","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/#article","isPartOf":{"@id":"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/"},"author":{"name":"Erica Maier","@id":"https:\/\/law.temple.edu\/10q\/#\/schema\/person\/d88f9d6c1e573914b328a9fc287d495a"},"headline":"Is Your Company Prepared for the New Cyber Incident Reporting Requirements?","datePublished":"2022-11-18T19:44:54+00:00","mainEntityOfPage":{"@id":"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/"},"wordCount":648,"commentCount":0,"image":{"@id":"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/#primaryimage"},"thumbnailUrl":"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2022\/11\/computer-g1b91f50e9_1920.jpg","keywords":["Compliance","corporate governance","Cyber crime","Cyber Security","Infrastructure","Privacy","Technology"],"articleSection":["Alumni Authored","Compliance","Corporate Governance","Technology"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/","url":"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/","name":"Is Your Company Prepared for the New Cyber Incident Reporting Requirements? - The Temple 10-Q","isPartOf":{"@id":"https:\/\/law.temple.edu\/10q\/#website"},"primaryImageOfPage":{"@id":"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/#primaryimage"},"image":{"@id":"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/#primaryimage"},"thumbnailUrl":"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2022\/11\/computer-g1b91f50e9_1920.jpg","datePublished":"2022-11-18T19:44:54+00:00","author":{"@id":"https:\/\/law.temple.edu\/10q\/#\/schema\/person\/d88f9d6c1e573914b328a9fc287d495a"},"breadcrumb":{"@id":"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/#primaryimage","url":"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2022\/11\/computer-g1b91f50e9_1920.jpg","contentUrl":"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2022\/11\/computer-g1b91f50e9_1920.jpg","width":1920,"height":1256},{"@type":"BreadcrumbList","@id":"https:\/\/law.temple.edu\/10q\/is-your-company-prepared-for-the-new-cyber-incident-reporting-requirements\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/law.temple.edu\/10q\/"},{"@type":"ListItem","position":2,"name":"Is Your Company Prepared for the New Cyber Incident Reporting Requirements?"}]},{"@type":"WebSite","@id":"https:\/\/law.temple.edu\/10q\/#website","url":"https:\/\/law.temple.edu\/10q\/","name":"The Temple 10-Q","description":"Temple's Business Law Magazine","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/law.temple.edu\/10q\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/law.temple.edu\/10q\/#\/schema\/person\/d88f9d6c1e573914b328a9fc287d495a","name":"Erica Maier","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/287d6d70b5641c5fca2014a2642c81f4173a498c7b1d1dafac589e1a9dc74e18?s=96&d=mm&r=g5e523333d61dc7fabb86b49c5ffcbaee","url":"https:\/\/secure.gravatar.com\/avatar\/287d6d70b5641c5fca2014a2642c81f4173a498c7b1d1dafac589e1a9dc74e18?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/287d6d70b5641c5fca2014a2642c81f4173a498c7b1d1dafac589e1a9dc74e18?s=96&d=mm&r=g","caption":"Erica Maier"},"url":"https:\/\/law.temple.edu\/10q\/author\/emaier\/"}]}},"jetpack_featured_media_url":"https:\/\/law.temple.edu\/10q\/wp-content\/uploads\/sites\/12\/2022\/11\/computer-g1b91f50e9_1920.jpg","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/posts\/3469","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/users\/33"}],"replies":[{"embeddable":true,"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/comments?post=3469"}],"version-history":[{"count":0,"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/posts\/3469\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/media\/3471"}],"wp:attachment":[{"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/media?parent=3469"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/categories?post=3469"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/tags?post=3469"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/law.temple.edu\/10q\/wp-json\/wp\/v2\/coauthors?post=3469"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}