The Biden administration has expressed to congressional representatives its strong opposition to undoing the Securities and Exchange Commission's strict data breach reporting rule.
The joint resolution, along with House Joint Resolution 100, sponsored by Representative Andrew Garbarino and introduced the same day, would nullify the SEC rules adopted in July of last year.
The SEC's rule require public companies hit by cybercriminals to report the incident within four days.
Undoing any breach reporting requirement seems antithetical to the work a Senator ought to be doing; we asked Tillis's office to explain his reasoning, but didn't hear back.
Garbarino, on the other hand, issued a statement in November after submitting his companion resolution in the House that makes his position on the matter clear: Breach reporting requirements are the Cybersecurity and Infrastructure Security Agency's job.
Garbarino said Congress and the Biden administration are on the same page with regards to harmonizing cybersecurity reporting requirements.
Part of those concerns may stem from the public nature of SEC incident reports, which have to be submitted on SEC Form 8-K, the contents of which are public.
Disclosures must include the scope, timing, and nature of the incident, though disclosure may be delayed if the US Attorney General determines doing so would pose a risk to national security or public safety.
It's not clear what the Senator and Congressman think of the Federal Trade Commission's 30-day breach reporting requirement passed in October, which isn't mentioned in the earlier statement or resolutions.
Despite Garbarino's professed belief that CISA is the one that should be handling breach reporting requirements, the agency has yet to pass any rules that would do so.
President Biden signed the Cyber Incident Reporting for Critical Infrastructure Act into law in March 2022, but CISA had 24 months from passage to present a rule for consideration, which it has yet to do.
When CISA's reporting requirements eventually go into effect, the disclosure window will be even smaller than the SEC's.
CIRCIA asked CISA to give cybersecurity incident victims a mere 72 hours - three days - to report a breach.
In the meantime, the FTC and SEC have taken matters into their own hands, which appears to be helping - we've even been able to report on breaches at companies like HPE thanks to SEC reports.
As previously reported, the number of victims paying ransomware operators has fallen to 29 percent.
The company behind that statistic, ransomware negotiation firm Coveware, attributes much of the decrease in ransom payments in recent months to reporting requirements from the SEC and FTC. Those payments are down despite what the White House OMB said was a 45 percent increase in ransomware attacks year-over-year.
Maybe giving the SEC cybersecurity reporting authority isn't the best move - after all, the agency can't even keep its Twitter account secure.
This Cyber News was published on go.theregister.com. Publication date: Thu, 01 Feb 2024 17:43:04 +0000