List the facts of a ransom payment without preparing a CIRCIA report
Key facts
- Human involvement
- RedLawyer-led
- How AI is used
- List the payment date, the amount, and the recipient as the documents print them, with the page. Write no sentence of a report.
- What the lawyer must review
- 6 U.S.C. § 681b(a)(1) states that a covered entity that experiences a covered cyber incident shall report it to the Agency not later than 72 hours after the entity reasonably believes the incident occurred, and the Director may not require reporting any earlier than that. Section 681b(a)(2) states that a covered entity that makes a ransom payment as the result of a ransomware attack shall report the payment not later than 24 hours after it is made, even if the attack is not a covered cyber incident. The same section states that paragraphs (1) through (4) take effect on the dates prescribed in the final rule. CISA's CIRCIA page says reporting of covered cyber incidents and ransom payments will not be required until the final rule goes into effect, and that CISA continues to work on that rule. You do not send a report on the strength of these pages. There is no asset-register duty and no annual risk-management-program report in the pages that were opened.
- Written for / version
- United States versionUS
Who does what
| Role | What they do |
|---|---|
| Assistance | Supporting preparation only. Consider narrowly defined preparation support after confirming the tool’s capability and permitted scope. The tool writes nothing into the document. Substantive advice, judgement and any restricted content remain with the responsible human. |
| Lawyer | Perform the substantive analysis and decisions. Independently check any permitted supporting work and approve the exact output for its intended use. |
Checklist
- Trace every relied-on figure to its source, confirm dates and assumptions, and independently recalculate totals or derived amounts.
- Obtain and inspect the relevant current official register or search result. Confirm identities, interests and the date and scope of the search.
- Confirm the output against the client’s instructions and the complete relevant source material, including omissions or contradictions.
- Resolve exceptions and record the responsible lawyer’s approval of the exact output and intended use.