The long, bumpy road to cyber incident reporting legislation — and the one still ahead

“This is the first comprehensive requirement for all sectors of critical infrastructure to report incidents and ransomware payments,” the aide said. “It’s going to take a while to write this rule for a policy of historical magnitude,” and give private sector groups time have weigh in on it.

Kiersten Todt, chief of staff at CISA, said the agency got an early start on handling the reporting requirements even before the bill was signed into law. For example, the agency set up a reporting email, [email protected]

“We’re not going to wait for the rulemaking to not move forward,” Todt said at an event hosted Tuesday by security company NeoSystems. “The point is that we’re ready. We’re working with the FBI and our partners to move forward.”