Following the release of the Trump Administration’s new National Cyber Strategy, National Cyber Director Sean Cairncross noted in a virtual interview that the administration is considering changes to the existing cyber incident reporting rules previously promulgated by the Cybersecurity and Infrastructure Security Agency (CISA). According to Cairncross, the administration wants to ensure the rules “make[] sense for industry” while still providing the government with actionable threat intelligence.
Federal agencies, including CISA, are still gathering feedback on proposals for changes to the rules, and the administration has not yet committed to any specific changes. Still, given Cairncross’s recent comments, companies should expect to see changes to the rules in the near future and be prepared to promptly conform their existing incident response plans and reporting protocols accordingly.