Education Leaders' Guide to the New Cyberattack Reporting Requirements

When critical infrastructure is hit by a disruptive cyberattack, national security officials need to know about it as soon as possible. That’s the guiding principle behind new rules coming soon from the U.S. Cybersecurity and Infrastructure Security Agency (CISA).

In March 2022, the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) was signed into law.  Enactment of CIRCIA means CISA will require covered entities designated as critical infrastructure to report covered cyber incidents and ransomware payments. These reports are meant to allow CISA to analyze incoming reporting across sectors to spot trends and quickly share that information with network defenders to warn other potential victims.

In March 2024, CISA is expected to release proposed cyberattack reporting requirements for 16 categories of critical infrastructure, which includes educational institutions. Schools at all levels, from kindergarten through post-secondary institutions, need to be ready. Education leaders who review the anticipated regulations stand a better chance of staying compliant when the new rules come into effect, as well as have the opportunity to submit feedback to CISA around the proposed regulations before they are finalized.

Join Government Technology and Sophos for a live 30-minute webinar to learn more about the new reporting requirements and how education leaders can prepare for the upcoming changes.

You’ll Learn:

• What information schools will likely have to report according to the proposed CIRCIA rules
• What constitutes a ‘covered incident’ that must be reported
• How to best prepare for the proposed CIRCIA requirements