RSA CONFERENCE 2024 - San Francisco - The Cybersecurity and Infrastructure Security Administration has tagged an additional 30 days onto the window for the private sector to provide feedback on proposed Cyber Incident Reporting for Critical Infrastructure incident reporting rules.
The agency has to maintain an open and collegial relationship with the private sector because it simply doesn't have the resources necessary to do the job in-house.
The reality of imposing another set of disclosure deadlines, on top of Security and Exchange Commission regulations and state and local requirements, brings concerns about potentially piling more red tape onto victims of a cybercrime, and ultimately slowing down incident response.
After saddling CISA with the responsibility of collecting CIRCIA reporting, Congress denied any additional funding to help them resource up for the job.
Now CISA is stuck - and asking for help from the same group it's required to regulate.
CISA executive director Brandon Wales tried to downplay enforcement and instead implored the cyber community to view sharing their incident data with the federal government as a gesture of goodwill to shore up the entire country's cyber defenses.
Bergin reminded the audience that failure to comply with the regulation could result in organizations being banned from doing any business with the federal government.
Individual enterprise victims won't likely see a direct benefit from sharing their intelligence with CISA, Wales explained, but will see improvements in the long run as the agency is able to do a better job at defending because it is aided by data from across the US infrastructure ecosystem.
Wales added that CISA is trying to become the singular repository for incident reporting, meaning organizations that have overlapping oversight from federal and state agencies could see a simpler process following the implementation of CIRCIA reporting rules.
Large cyber organizations like CrowdStrike have been working with CISA through the Joint Cyber Defense Collaborative, while also acting as a vendor to the agency.
CISA will accept recommendations on CIRCIA rules via the Federal Register through July 3.
This Cyber News was published on www.darkreading.com. Publication date: Fri, 10 May 2024 00:10:15 +0000