Nextgov, March 11, 2022

By Mariam Baksh

Legislation requiring private companies to report cybersecurity incidents to the Cybersecurity and Infrastrcucture Security Agency could hitch a ride to the president’s desk in an omnibus spending bill set for consideration in the Senate Thursday following House passage.

“We believe the 72 hours should run, not from an entity’s reasonable belief, but from knowledge that a covered incident occurred,” Henry Young, policy director for BSA | The Software Alliance, said in an email reacting to the Senate’s passage of the incident reporting legislation. “Prior to knowing, a company is still investigating, and its focus should be on determining whether there is anything to respond to and report. If the bill becomes a law, BSA looks forward to working with DHS to do the important and challenging work of defining ‘covered entity’ and ‘covered cyber incident."

Read More >>

Original Posting: https://www.nextgov.com/cybersecurity/2022/03/cyber-incident-reporting-legislation-clears-house-bipartisan-spending-bill/363022/