CISA Sends Cyber Reporting ANPRM to OMB

YYesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had received a ‘Prerule’ notice (typically called an advanced notice of proposed rulemaking – ANPRM - or maybe an RFI) from CISA on “Request for Information on the Cyber Incident Reporting for Critical Infrastructure Act of 2022”. While this rulemaking was not included in the Spring 2022 Unified Agenda, it seems pretty obvious that this is the initial stages of the regulatory efforts that would support the requirements of Division Y of PL 117-203 that was signed into law in March. The actual reporting requirement mandate is found at 6 USC 681b and §681c.

CISA appears to be moving fairly quickly on their mandate. It will be interesting to see how quickly OMB approves the ANPRM/RFI.