Seeking harmony: CISA’s proposed cyber reporting rules for critical infrastructure are an ambitious work in progress

The federal cyber incident reporting regulations proposed by the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) are ambitious and laudable but, with some modest changes, could go even farther to protect US critical infrastructure. First, to reduce the growing burden of duplicative and overlapping reporting obligations, CISA should take more concrete steps to harmonise its proposed cyber incident reporting requirements with those of other federal, state and local agencies. Secondly, CISA should provide greater clarity on the types of data that must be preserved following a reportable cyber incident and shorten the default preservation period to six months, with an option to extend it if necessary. Finally, CISA should provide additional guidance about how the reporting requirements apply to the international operations of multinational companies. By offering additional clarity and reducing the burden on private sector entities, CISA could create a streamlined cyber incident report regime that is more closely aligned with the goal of providing timely, essential and actionable information that will better protect the US critical infrastructure.