On March 2, 2022, the Senate unanimously passed the Strengthening American Cybersecurity Act of 2022 (“SACA” or the “Bill”). The Bill is now with the House of Representatives for a vote and, if passed, will be sent to President Biden’s desk for signature.
Introduced by Senators Rob Portman (R-OH) and Gary Peters (D-MI), the Bill uses language from three other bills: the Cyber Incident Reporting for Critical Infrastructure Act (S. 2875), the Federal Information Security Modernization Act (S. 2902) and the Federal Secure Cloud Improvement and Jobs Act (S. 3099). Notably, the Bill would require critical infrastructure operators to report “substantial cyber incidents” to the Cybersecurity and Infrastructure Security Agency (“CISA”) within 72 hours and report ransomware payment within 24 hours. The Bill also would include several other reforms intended to strengthen cybersecurity within the federal government, including:
requiring federal civilian agencies to report all substantial cyber incidents to CISA within 72 hours;
requiring certain information sharing to improve coordination between federal agencies;
authorizing the Federal Risk and Authorization Management Program (“FedRAMP”) for five years so that federal agencies can adopt cloud-based technologies.
The Bill also would authorize the Director of Office of Management and Budget, in consultation with Sector Risk Management Agencies, the Department of Justice and other federal agencies, to issue a regulation to implement SACA. This regulation would define and establish criteria for what constitutes a “substantial cyber incident.” It also would provide a description of the required contents of a cyber incident report or ransom payment report to CISA, building upon the requirements already listed in Sections 2242(c)(4)-(5) in the Bill.
Upon passage of the bill, Senator Peters said, “Our landmark, bipartisan bill will ensure CISA is the lead government agency responsible for helping critical infrastructure operators and civilian federal agencies respond to and recover from major network breaches and mitigate operational impacts from hacks. I will continue urging my colleagues in the House to pass this urgently needed legislation to improve public and private cybersecurity as new vulnerabilities are discovered, and ensure that the federal government can safety and securely utilize cloud-based technology to save taxpayer dollars.”
Read the Bill and track its status.
About this Author
In today’s digital economy, companies face unprecedented challenges in managing privacy and cybersecurity risks associated with the collection, use and disclosure of personal information about their customers and employees. The complex framework of global legal requirements impacting the collection, use and disclosure of personal information makes it imperative that modern businesses have a sophisticated understanding of the issues if they want to effectively compete in today’s economy.
Hunton Andrews Kurth LLP’s privacy and cybersecurity practice helps companies manage data and…
You are responsible for reading, understanding and agreeing to the National Law Review’s (NLR’s) and the National Law Forum LLC’s Terms of Use and Privacy Policy before using the National Law Review website. The National Law Review is a free to use, no-log in database of legal and business articles. The content and links on www.NatLawReview.com are intended for general information purposes only. Any legal analysis, legislative updates or other content and links should not be construed as legal or professional advice or a substitute for such advice. No attorney-client or confidential relationship is formed by the transmission of information between you and the National Law Review website or any of the law firms, attorneys or other professionals or organizations who include content on the National Law Review website. If you require legal or professional advice, kindly contact an attorney or other suitable professional advisor.
Some states have laws and ethical rules regarding solicitation and advertisement practices by attorneys and/or other professionals. The National Law Review is not a law firm nor is www.NatLawReview.com intended to be a referral service for attorneys and/or other professionals. The NLR does not wish, nor does it intend, to solicit the business of anyone or to refer anyone to an attorney or other professional. NLR does not answer legal questions nor will we refer you to an attorney or other professional if you request such information from us.
Under certain state laws the following statements may be required on this website and we have included them in order to be in full compliance with these rules. The choice of a lawyer or other professional is an important decision and should not be based solely upon advertisements. Attorney Advertising Notice: Prior results do not guarantee a similar outcome. Statement in compliance with Texas Rules of Professional Conduct. Unless otherwise noted, attorneys are not certified by the Texas Board of Legal Specialization, nor can NLR attest to the accuracy of any notation of Legal Specialization or other Professional Credentials.
The National Law Review – National Law Forum LLC 3 Grant Square #141 Hinsdale, IL 60521 Telephone (708) 357-3317 or toll free (877) 357-3317. If you would ike to contact us via email please click here.
