CISA Releases Draft Guidelines for Reporting Cyberattacks on Critical Infrastructure

Organizations will be obligated to disclose ’substantial' cyberattacks and ransom payments within 72 and 24 hours, respectively.

File photo of a hacker on his computer. Nicolas Asfouri/AFP via Getty Images

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released proposed regulations on March 27 governing the manner in which companies with critical infrastructure are required to notify the government of cyberattacks.

The regulations were formulated by CISA subsequent to the enactment of the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) by President Joe Biden on March 15, 2022.