{"id":53799,"date":"2022-04-27T16:52:50","date_gmt":"2022-04-27T12:52:50","guid":{"rendered":"https:\/\/www.msp360.com\/resources\/?p=53799"},"modified":"2024-08-14T12:25:58","modified_gmt":"2024-08-14T08:25:58","slug":"an-msps-guide-to-the-cyber-incident-reporting-for-critical-infrastructure-act-of-2022","status":"publish","type":"post","link":"https:\/\/www.msp360.com\/resources\/blog\/an-msps-guide-to-the-cyber-incident-reporting-for-critical-infrastructure-act-of-2022\/","title":{"rendered":"MSP Guide for Cyber Incident Reporting and Critical Infrastructure Act"},"content":{"rendered":"

For MSPs, detecting and documenting cybersecurity incidents has always been important. But now, it\u2019s a formal legal requirement in some cases, thanks to the recently enacted Cyber Incident Reporting for Critical Infrastructure Act of 2022.<\/p>\n

The new law, which is a response to the recent spate of cyberattacks and ransomware incidents, mandates that companies report certain types of security incidents to the U.S. federal government within 72 hours of discovery of the incident, and 24 hours if they make a ransomware payment. This reporting requirement legislation was passed as part of the omnibus spending bill that Congress approved in March 2022.<\/p>\n

Keep reading for details on the law\u2019s requirements, and what they mean for MSPs.<\/p>\n

What is the Cyber Incident Reporting for Critical Infrastructure Act of 2022?<\/h2>\n

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 is a law that requires businesses that own or manage \u201ccritical infrastructure\u201d to report security incidents to the U.S. Cybersecurity and Infrastructure Security Agency (CISA). The U.S. federal government passed the law in March 2022.<\/p>\n

Under the law, businesses need to notify CISA when they experience an incident involving at least one of the following:<\/p>\n

    \n
  1. (i) Unauthorized access to an information system or network that leads to loss of confidentiality, integrity, or availability of such information system or network, or has a serious impact on the safety and resiliency of operational systems and processes.<\/li>\n
  2. (ii) Disruption of business or industrial operations due to a denial of service attack, a ransomware attack, or exploitation of a zero-day vulnerability, against\u2014<\/li>\n
  3. (I) an information system or network; or<\/li>\n
  4. (II) an operational technology system or process.<\/li>\n
  5. (iii) Unauthorized access or disruption of business or industrial operations due to loss of service facilitated through, or caused by a compromise of, a cloud service provider, managed service provider, other third-party data hosting provider, or supply chain attack.<\/li>\n<\/ol>\n

    These requirements are included in the text of the law<\/a>.<\/p>\n

    What Information Must be Reported to CISA?<\/h2>\n

    It remains to be seen exactly how CISA will interpret the law, so it\u2019s unclear at this point what the specific reporting requirements will be. However, the act establishes certain minimum reporting requirements; it says that reports for a cyber incident report will include the following, if \u201capplicable and available\u201d:<\/p>\n