House panel mulls mandatory disclosure bill

Mandatory breach disclosure requirements were not included in the Cybersecurity and Information Sharing Act of 2015, but the political landscape has changed in the wake of the hacks of Colonial Pipeline, SolarWinds and the targeted exploitation of a critical flaw in Microsoft Exchange servers.

The House Homeland Security Committee is moving ahead with a bill to require covered critical infrastructure companies to report hacks to the federal government, and this time industry is on board.

The bipartisan Cyber Incident Reporting for Critical Infrastructure Act of 2021 is still a work in progress, but at a Sept. 1 hearing of the Subcommittee on Cybersecurity, Infrastructure Protection and Innovation, industry representatives endorsed the plan to require privately owned critical infrastructure firms to disclose cybersecurity incidents to the Cybersecurity and Infrastructure Security Agency (CISA) within 72 hours of discovery.

The bill sets up a new office at CISA – the Cyber Incident Review Office – to securely receive and manage breach disclosure information from companies. The reporting requirement will not necessarily cover all 16 categories of critical infrastructure as defined by the Department of Homeland Security – those decisions will be made in the rulemaking process.

"I want to be clear that we do not expect all critical infrastructure owners and operators to be subject to this reporting requirement -- rather we expect it to apply only to a subset," Rep. Yvette D. Clarke (D-N.Y.), the chairwoman of the subcommittee, said in her opening statement.

 Additionally, the bill sets up a few definitions of what constitutes a covered incident – including the exploitation of zero-day bugs against a network or operational technology system and a breach that knocks out a critical system or has a "serious impact on the safety and resiliency of operational systems and  processes." Also covered are DDoS (distributed denial of service) attacks and ransomware.

Rep. Jim Langevin (D-R.I.), who is active on cybersecurity issues in Congress, said he was concerned that the reporting threshold could be set too high, and not take into account suspected breaches as they unfold.

"I'm a bit concerned about the gap of information CISA needs and the amount CISA would receive" if only confirmed cyber incidents were reported. He cited the example of a ransomware attack that had breached a network but not yet been activated to encrypt targeted data. Langevin cautioned that CISA could be in a position where it learns too late "to take meaningful action to mitigate threats."

On the industry side, there were concerns about oversharing – especially if the legislation covers certain vendors and third-party providers or requires cybersecurity firms to make disclosures to government as well as reporting to their clients.

"Such a requirement, if scoped broadly to incorporate third parties and vendors … could inundate CISA with multiple duplicative reports that they then must sift through, diverting limited resources away from meaningfully addressing significant cybersecurity incidents," John Miller, senior vice president of policy and general counsel at the Information Technology Industrial Council, told the subcommittee.

Additionally, there's concern about how the bill would affect industries that are already subject to cybersecurity regulations and disclosure requirements, such as electricity providers, financial firms, government contractors and others.

"For already regulated critical infrastructure sectors, it is vital to ensure new reporting requirements are harmonized with existing laws and regulations," Heather Hogsett, senior vice president, technology and risk strategy for the technology policy division of Bank Policy Institute, said at the hearing.

The bill establishes a 270-day period for the development of an interim rule, based in part on stakeholder input, that sets out who is covered, what needs to be reported, how reports are submitted and other implementation details.