Today, the Department of Homeland Security (DHS) outlined a series of actionable recommendations on how the federal government can streamline and harmonize the reporting of cyber incidents to better protect the nation’s critical infrastructure. These recommendations provide a clear path forward for reducing burden on critical infrastructure partners and enabling the federal government to better identify trends in malicious cyber incidents, as well as helping organizations to prevent, respond to, and recover from attacks. The recommendations, delivered to Congress today in a report, are a requirement of the landmark Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA). Key recommendations include establishing model definitions, timelines, and triggers for reportable cyber incidents; creating a model cyber incident reporting form that federal agencies can adopt; and streamlining the reporting and sharing of information about cyber incidents, including the assessment of a potential single reporting web portal. The report also notes that there are situations when incident reporting might be delayed, such as when it would pose a significant risk to critical infrastructure, national security, public safety, or an ongoing law enforcement investigation.
“In the critical period immediately following a cyber-attack, our private sector partners need clear, consistent information-sharing guidelines to help us quickly mitigate the adverse impacts,” said Secretary of Homeland Security Alejandro N. Mayorkas. “The recommendations that DHS is issuing today provide needed clarity for our partners. They streamline and harmonize reporting requirements for critical infrastructure, including by clearly defining a reportable cyber incident, establishing the timeline for reporting, and adopting a model incident reporting form. These recommendations can improve our understanding of the cyber threat landscape, help victims recover from disruptions, and prevent future attacks. I look forward to working with Congress and partners across every level of government and the private sector to implement these recommendations and strengthen the resilience of communities across the country.”
The recommendations reflected in the DHS report were developed in coordination with the Cyber Incident Reporting Council (CIRC), which was established in 2022 and is chaired by DHS Under Secretary for Policy Robert Silvers on behalf of the Secretary of Homeland Security, to coordinate, deconflict, and harmonize existing and future federal cyber incident reporting requirements.
“To develop these recommendations, the Cyber Incident Reporting Council analyzed over 50 different federal cyber incident reporting requirements and engaged with numerous industry and private sector stakeholders,” said DHS Under Secretary for Policy and CIRC Chair Robert Silvers. “It is imperative that we streamline these requirements. Federal agencies should be able to receive the information they need without creating duplicative burdens on victim companies that need to focus on responding to incidents and taking care of their customers. We look forward to working with Congress and across the Executive Branch to implement these recommendations.”
“Reporting cyber incidents is critical to the nation’s cybersecurity: It allows us to spot trends in real-time, rapidly render assistance to victims, and share information to warn other potential targets before they become victims,” said CISA Director Jen Easterly. “We also recognize that the need for this information must be balanced with the burdens placed on industry, ensuring that requirements are harmonized and streamlined as effectively as possible. As the Cybersecurity and Critical Infrastructure Agency (CISA) implements reporting requirements as part of the Cyber Incident Reporting for Critical Infrastructure Act, these recommendations – along with the extensive input from stakeholders submitted as part of our rulemaking process – will help inform our proposed rule.”
The CIRC includes representation from 33 federal agencies, including the Departments of Homeland Security, Treasury, Defense, Justice, Agriculture, Commerce, Health and Human Services, Transportation, and Energy, the Office of the National Cyber Director, the Securities and Exchange Commission, the Federal Trade Commission, and the Federal Communications Commission.
The report’s recommendations will inform CISA’s ongoing rulemaking process to implement landmark cyber incident reporting requirements applicable to covered critical infrastructure entities, as mandated under CIRCIA.
The report is available on DHS.gov.
