The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), signed in March 2022, is a law that requires the Cybersecurity and Infrastructure Security Agency (CISA) to develop rules for reporting cyber incidents.
A rule proposed in April 2024 and set to take effect in 2026 may require school districts that meet certain size and sector-based criteria to report cyber incidents within 72 hours and ransomware payments within 24 hours.
Increased reporting will allow for a better and more accurate examination of potential trends that may ultimately lead to a better defense systems. As cybersecurity becomes a greater concern for school districts, insight into the vulnerabilities of school district information systems will be critical to safety and improvement.
CISA’s proposed rule, published in the Federal Register in April, would implement the Cyber Incident Reporting for Critical Infrastructure Act of 2022, or CIRCIA. That law stipulates that entities covered by its reporting requirements must disclose disruptive cyber incidents within 72 hours from when the entity reasonably believes the incident occurred. They must also report to CISA any ransom payments made to cybercriminals within 24 hours of doing so.
