CISA announces town halls to gather public input on proposed cyber incident reporting requirements

The Cybersecurity and Infrastructure Security Agency announced Feb. 13 that it will host a series of virtual town hall meetings to gather public input on rulemaking for the Cyber Incident Reporting for Critical Infrastructure Act of 2022. The meetings will begin March 9, according to a Federal Register notice. The proposed rule, issued in March 2024, would require critical infrastructure organizations, including hospitals and health systems, to report a cyber incident to the federal government within 72 hours and ransom payments within 24 hours, among other requirements. The AHA commented on the proposed rule, calling the requirements redundant to those from other federal agencies and that they add unnecessary burden to hospitals working to ensure access to needed services during a cybersecurity incident response.