Bipartisan legislation that would require private sector companies to report ransomware attacks to federal authorities was advanced this week by the Senate Homeland Security and Governmental Affairs Committee. A broad, 37-member coalition that includes The Real Estate Roundtable on Oct. 4 provided detailed suggestions to Senate and House congressional committees about provisions that should be included in any bill that would impose a compulsory cyber incident notification program on the business community. (Cybersecurity coalition letter and Committee mark-up)

Why It Matters

• The Cyber Incident Reporting Act (S. 2875) – sponsored by Committee Chairman Gary Peters (D-MI) and Ranking Member Rob Portman (R-OH) – would require certain owners and operators of critical infrastructure operators to report hacks within 72 hours and ransom payments within 24 hours to the Cybersecurity and Infrastructure Security Agency (CISA).  Organizations failing to do so would potentially banned from doing business with the federal government. (The Hill, Set. 28 and PoliticoPro, Oct. 5)
  
  
• The committee also approved the Federal Information Security Modernization Act of 2021 (S. 2902), which would require agencies and contractors to report on cyberattacks.
  
  
• The congressional bills aim to update the Federal Information Security Modernization Act, signed into law in 2014. Sen. Portman noted two reports on issued by the Homeland Security Committee since 2019 that found massive cybersecurity shortcomings at several federal agencies.
  
  
• The Senate Homeland Security Committee’s leadership may seek to merge their legislation may with a bill (S. 2010) from the Senate Intelligence Committee. Sen. Peters said he may also seek to include S. 2875 in House-passed defense policy legislation (H.R. 4350), which also includes language requiring cyber incidents. (BGov and PoliticoPro, Oct. 5)

Private Sector Concerns

• The business coalition’s Oct. 4 letter to the Senate Committees on Intelligence, Homeland Security and Government Affairs and the House Committee on Home  recommended several provisions that should be central to a mandatory reporting regime, including:
  
  
  • Establish a prompt reporting timeline of not less than 72 hours. Legislation should reflect an appropriate, flexible standard for notifying government about significant cyber incidents.
    
    
  • Attach reporting to confirmed cyber incidents. Businesses need clarity in reporting requirements, which should be targeted to well-defined and confirmed cyber incidents.
    
    
  • Confine reports to significant and relevant incidents .A list should be limited in reach—particularly excluding small businesses using existing federal rules—and risk based.
    
    
  • The business industry comments recommended that federal cybersecurity reporting legislation should also include robust liability protections; consistent federal reporting requirements; restrictive government use of reported data; and guarantee substantial input from industry to protect the rulemaking process. 

Identifying Critical Infrastructure

• In the House, a separate bill that would identify systemically important infrastructure was introduced Oct. 5 by Homeland Security Committee Ranking Member John Katko (R-NY), Rep. Abigail Spanberger (D-VA) and Rep. Andrew Garbarino (R-NY). (Katko one-pager on the bill)
  
  
• The bill would authorize CISA to prioritize infrastructure operators considered so crucial to the U.S. economy, public health and national security that a disruption to their operations due to a cyberattack would be considered debilitating. (Katko news release, Oct. 5) 

The Roundtable’s Homeland Security Task Force continues to work with key law enforcement and intelligence agencies and the Real Estate Information Sharing and Analysis Center (RE-ISAC) on protective measures that businesses can take to create infrastructure resistant to physical damage and cyber breaches.  

#  #  #