CISA Schedules Virtual Town Hall for Counties to Comment on Key Cybersecurity Reporting Rule

Key Takeaways

On May 26, the Cybersecurity and Infrastructure Security Agency (CISA) announced a revised schedule for virtual town hall meetings to discuss ongoing rulemaking under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022. CISA has been planning to implement a 2024 Notice of Proposed Rulemaking that establishes new requirements for all critical infrastructure sectors, including counties, to report cyber incidents and ransomware payments under a specified period of time to federal authorities. The rulemaking is under further review, and CISA has invited stakeholders to comment on the issue to help inform the agency’s path forward.

The virtual town hall for counties will be held on June 16 from 11:30am – 3:30pm Eastern Time (ET). Registration is required and can be made here.

What is the county connection?

Signed into law in 2022, CIRCIA requires CISA to develop regulations mandating that "covered entities" — including county governments — report significant cyber incidents to the federal government within 72 hours and ransom payments within 24 hours. As CISA works to finalize the scope and compliance burden of the CIRCIA rule, counties can participate and share their experience in how a federally mandated cyber incident reporting mechanism should work. NACo previously submitted comments to CISA to help inform their 2024 Notice of Proposed Rulemaking process. 

NACo will continue to monitor the CIRCIA rulemaking and engage with CISA on behalf of counties. Members can view the full Federal Register notice here.