U.S. Senate Passes Cybersecurity Bill to Strengthen Critical Infrastructure Security

The U.S. Senate unanimously passed^[1]
the “Strengthening American Cybersecurity Act” on Tuesday in
an attempt to bolster the cybersecurity of critical infrastructure
owners in the country.

The new bipartisan legislation^[2], among other things,
stipulates entities that experience a cyber incident to report the
attacks within 72 hours to the U.S. Cybersecurity and
Infrastructure Security Agency (CISA), in addition to alerting the
agency about ransomware payments within 24 hours.

Furthermore, affected organizations are required to preserve
relevant data and promptly share updates “to a previously submitted
covered cyber incident report if substantial new or different
information becomes available or if the covered entity makes a
ransom payment after submitting a covered cyber incident
report.”

The Strengthening American Cybersecurity Act of 2022 combines
three different bills: the Cyber Incident Reporting Act (CIRA^[3]), the Federal
Information Security Management Act (FISMA^[4]), and the Federal Secure
Cloud Improvement and Jobs Act (FSCIJA^[5]).

While FISMA incorporates more effective cybersecurity practices,
FSCIJA aims to accelerate the deployment of cloud computing
products and services, and drive stronger adoption of secure cloud
capabilities, create jobs, and reduce dependency on legacy
information technology.

The legislation, now that it has been approved by the Senate,
needs to be passed by the House before it’s officially signed into
law.

“As cyber and ransomware attacks continue to increase, the
federal government must be able to quickly coordinate a response
and hold these bad actors accountable,” said U.S. Senator Rob
Portman in September 2021.

“This bipartisan bill will give […] broad visibility into the
cyberattacks taking place across our nation on a daily basis to
enable a whole-of-government response, mitigation, and warning to
critical infrastructure and others of ongoing and imminent
attacks.”