Map critical-infrastructure cyber incident reporting duties
Key facts
- Human involvement
- YellowClose supervision
- How AI is used
- Build a table that separates what 6 USC section 681b says on its face from what CISA says is in force today. Do not mark a report as currently required.
- What the lawyer must review
- Section 681b says a covered entity that experiences a covered cyber incident shall report it to CISA not later than 72 hours after the entity reasonably believes the incident occurred, and that the Director may not require reporting any earlier than that. A ransom payment is reportable even if the attack is not a covered cyber incident. The same section says those duties take effect on the dates in the final rule, and that reports are made in the manner the final rule prescribes. CISA's CIRCIA page states that covered-incident and ransom-payment reporting under CIRCIA will not be required until the final rule goes into effect, that CISA is still working on the final rule, and that reporting before then is voluntary. Do not advise a client that the 72-hour report is currently mandatory. Opinion 512: the chronology of an incident is client confidential information.
- Written for / version
- United States versionUSCth
Who does what
| Role | What they do |
|---|---|
| Assistance | Consider narrowly defined preparation support after confirming the tool’s capability and permitted scope. |
| Lawyer | Set the scope, supervise the work closely, verify every part relied on, resolve omissions and exceptions, and approve the exact output. |
Checklist
- Trace every relied-on figure to its source, confirm dates and assumptions, and independently recalculate totals or derived amounts.
- Confirm that the actual tool, feature and processing terms permit use of this information, including access, retention, training and disclosure conditions.
- Verify dates, people and sequence against contemporaneous records. Preserve uncertainty and identify gaps or conflicting accounts.
- Verify the applicable jurisdiction and the version of each relevant law, rule or instrument in force at the material time.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.