OMB Approves CISA’s Notice on Cybersecurity of Bulk Personal Information Transfers

Yesterday, the OMB’s Office of Information and Regulatory Affairs (OIRA) announced that it had approved a ‘notice’ from CISA on “Security Requirements for Restricted Transactions Under Executive Order 14117”. The notice was sent to OIRA on July 8^th, 2024.

This rulemaking was not published in the Spring 2024 Unified Agenda. This could be because this is a ‘notice’ not an actual proposed rulemaking.

As I noted in my earlier post:

“Executive Order 14117 outlines the Administration’s intent “to restrict access by countries of concern to Americans' bulk sensitive personal data and United States Government-related data when such access would pose an unacceptable risk to the national security of the United States.” Section 2(d) of that EO requires CISA to “propose, seek public comment on, and publish security requirements that address the unacceptable risk posed by restricted transactions”. Those ‘restricted transactions’ are outlined in §2(a) and are to be further defined by regulations issued by the Attorney General.”

I will probably not be covering these regulations in any depth in this blog, but I will certainly be announcing the relevant publications in the appropriate ‘Short Takes’ post.