DHS council seeks to simplify cyber incident reporting rules

The Biden administration is looking to simplify the dizzying reporting requirements faced by critical infrastructure entities.

The Department of Homeland Security delivered a 100-page report on Tuesday with recommendations on how to revamp the thicket of cyber incident reporting requirements faced by U.S. critical infrastructure operators.

Developed by the Cyber Incident Reporting Council — a body made up of multiple federal agencies including the Office of the National Cyber Director, Federal Trade Commission and the Departments of Energy, Treasury, Defense and Justice — Tuesday’s report found that critical infrastructure entities face a dizzying 45 active reporting requirements from 22 different federal agencies and and an additional five under consideration.

Harmonizing these requirements is a part of a larger Biden administration effort to develop more effective cyber policy, which has been shaped by an ad hoc approach from multiple agencies with varying authorities and resources.

“Reporting cyber incidents is critical to the nation’s cybersecurity: It allows us to spot trends in real-time, rapidly render assistance to victims, and share information to warn other potential targets before they become victims,” CISA Director Jen Easterly said in a statement. “We also recognize that the need for this information must be balanced with the burdens placed on industry, ensuring that requirements are harmonized and streamlined as effectively as possible.”

The Cyber Incident Reporting Council worked with more than 30 federal agencies in developing their recommendations. While CISA’s proposed rule on cyber incident reporting is not expected until next year, the report will shape the rule.

The council’s report was required under the Cyber Incident Reporting for Critical Infrastructure Act, a landmark bill that seeks to harmonize existing cyber incident reporting requirements and require new ones for critical infrastructure owners and operators.

Having a unified reporting requirement across critical infrastructure is expected to help both the private sector and federal government better understand the threat landscape while also assisting in prioritization efforts, and Tuesday’s report recommends that the requirements and submission process for incident reporting be as uniform as possible across sectors.

Within cyber incident reporting, the varying requirements represent a “significant challenge to harmonizing current” reporting requirements, the report notes. What qualifies as an incident, how soon an incident should be reported and how it should be reported are among the issues that need to be simplified, according to the report.

The report recommends that the federal government have a model definition for a “reportable cyber incident” and that agencies should examine whether they can adapt to such a definition. Agencies that have reporting requirements should also consider delayed public notifications if public notification poses a national security risk, the report notes.

The council’s report recommends that incidents that impact “national and economic security and safety” may need to be reported more promptly than the 72 hours that is the current reporting timeline under CIRCIA. Impacts to personal private information may be treated with greater flexibility, the council’s report suggests.

Additionally, the report argues that the process for engaging with victims should be improved so multiple agencies are not asking for the same information.

Updated incident reporting rules to be more in line with one another will likely be a long process. Such procedures can last months if not years — assuming the agency even has the authority to make such changes, the report warns. The Environmental Protection Agency, for example, told the council that the agency does not have the authority to require reporting from utilities.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure