article thumbnail

Congress Agrees – 72 Hour Cyber Incident Reporting Requirement to Take Effect

Data Protection Report

The Act will require a “covered entity” to report any “substantial cyber incident” to the Cybersecurity and Infrastructure Security Agency (“CISA”) within 72 hours after the covered entity reasonably believes the incident has occurred. Reporting Requirements. New Government Programs.