Privacy & Information Security Law Blog

On March 2, 2022, the Senate unanimously passed the Strengthening American Cybersecurity Act of 2022 (“SACA” or the “Bill”). The Bill is now with the House of Representatives for a vote and, if passed, will be sent to President Biden’s desk for signature.

Introduced by Senators Rob Portman (R-OH) and Gary Peters (D-MI), the Bill uses language from three other bills: the Cyber Incident Reporting for Critical Infrastructure Act (S. 2875), the Federal Information Security Modernization Act (S. 2902) and the Federal Secure Cloud Improvement and Jobs Act (S. 3099). Notably, the Bill would require critical infrastructure operators to report “substantial cyber incidents” to the Cybersecurity and Infrastructure Security Agency (“CISA”) within 72 hours and report ransomware payment within 24 hours. The Bill also would include several other reforms intended to strengthen cybersecurity within the federal government, including:

• requiring federal civilian agencies to report all substantial cyber incidents to CISA within 72 hours;
• requiring certain information sharing to improve coordination between federal agencies;
• authorizing the Federal Risk and Authorization Management Program (“FedRAMP”) for five years so that federal agencies can adopt cloud-based technologies.

The Bill also would authorize the Director of Office of Management and Budget, in consultation with Sector Risk Management Agencies, the Department of Justice and other federal agencies, to issue a regulation to implement SACA. This regulation would define and establish criteria for what constitutes a “substantial cyber incident.” It also would provide a description of the required contents of a cyber incident report or ransom payment report to CISA, building upon the requirements already listed in Sections 2242(c)(4)-(5) in the Bill.

Upon passage of the bill, Senator Peters said, “Our landmark, bipartisan bill will ensure CISA is the lead government agency responsible for helping critical infrastructure operators and civilian federal agencies respond to and recover from major network breaches and mitigate operational impacts from hacks. I will continue urging my colleagues in the House to pass this urgently needed legislation to improve public and private cybersecurity as new vulnerabilities are discovered, and ensure that the federal government can safety and securely utilize cloud-based technology to save taxpayer dollars.”

Read the Bill and track its status.