{"id":50435,"date":"2022-05-31T09:07:47","date_gmt":"2022-05-31T01:07:47","guid":{"rendered":"https:\/\/version-2.com\/?p=50435"},"modified":"2022-06-08T17:40:22","modified_gmt":"2022-06-08T09:40:22","slug":"the-new-us-cybersecurity-act-what-it-means","status":"publish","type":"post","link":"https:\/\/version-2.com\/zh\/2022\/05\/the-new-us-cybersecurity-act-what-it-means\/","title":{"rendered":"The New US Cybersecurity Act & What it Means"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

\"\"<\/p>\n

If you face a major cyber attack or pay ransom to attackers, you may have to report it to the Cybersecurity and Infrastructure Security Agency (CISA<\/a>) within a certain timeframe under the new cybersecurity law .<\/p>

The Strengthening American Cybersecurity Act of 2022<\/a>, which became law in March 2022, imposes strict reporting obligations on critical infrastructure owners\/operators: Entities operating and\/or owning critical infrastructure have to notify the CISA of the ransomware payment within 24 hours and of the major cyber incidents within 72 hours.<\/p>

Who is covered by the new requirements? When and how are cyber incidents reported under the new law? Keep reading to find out more.<\/p>

What is Strengthening American Cybersecurity Act of 2022? <\/b><\/h3>

Although the new requirements on incident-reporting makes the headlines, the new cyber security law is composed of three separate regulations:<\/p>

  1. The Cyber Incident Reporting for Critical Infrastructure Act of 2022: <\/b>This regulation imposes on critical infrastructure operators the obligation to notify the CISA of \u201ccovered cyber incidents\u201d and \u201cransom payments\u201d within a certain timeframe.<\/li>
  2. The Federal Information Security Modernization Act of 2022: <\/b>This regulation contains requirements on federal information security management and on reporting of cyber attacks and how these attacks will be remedied<\/li>
  3. The Federal Secure Cloud Improvement and Jobs Act of 2022: <\/b>This regulation deals with the security requirements for the use of cloud products.<\/li><\/ol>

    What Entities Are Covered<\/b> in the Cybersecurity Act?<\/h3>

    Under the new law, the CISA will have the power to decide what types of entities will be subject to the new incident-reporting requirements.<\/p>

    While the CISA is provided with wide discretion, the law requires the CISA to consider the following three factors when determining the \u201ccovered entities\u201d:<\/p>