Cybersecurity Leaders Approve of Peters-Portman Cyber Incident Reporting Bill

Cybersecurity and Infrastructure Security Agency Director Jen Easterly and National Cyber Director Chris Inglis backed a bill introduced by Sens. Gary Peters and Rob Portman that requires critical infrastructure operators to report internal cyber breaches to CISA within the first 72 hours of detection.

Speaking at a Sept. 23 Senate hearing, Easterly described incident reporting as “absolutely critical” and touted CISA’s role in sharing cyber threat information across agencies and critical infrastructure sectors.

According to Easterly, CISA can use reported cyber breach data not only to carry out remediation efforts but also to determine whether evidence of intrusions extends beyond a certain sector and may have spilled over to the federal civilian executive branch, Federal News Network reported Thursday.

However, she believes there is room for improvement in the bill, particularly in enforcing compliance.

Easterly argued that enforcing fines is better than simply giving CISA subpoena authority should companies refuse to comply with the reporting requirements.

Inglis concurred with the recommendation, adding that there should be incentives for reporting cyber breaches.

“We of course don’t want to impose an unfair burden on the victims. But this information is essential for the welfare of the whole,” Inglis said.

Another cyber incident reporting bill, introduced by Rep. Yvette Clarke, gives organizations at least 72 hours to report cyber breaches to the federal government.

Cybersecurity companies and industry groups testified in a previous hearing that the 72-hour timeline gives organizations a reasonable amount of time to properly assess cyberattacks as opposed to the 24-window offered by a Senate bill circulating in Congress.