by Nicholas S. Goldin, Lori E. Lesser, Melanie D. Jolson, and Shanice D. Hinckson
Tucked into the recently enacted 2022 Consolidated Appropriations Act is the Cyber Incident Reporting for Critical Infrastructure Act (the “Act”), which will—once effective—significantly expand the obligation of[1] companies in the energy, communications, financial services and other critical infrastructure sectors to report a range of cyberattacks and ransomware payments. This broad-based federal cyber incident reporting requirement comes on the heels of cyber disclosure rules recently proposed by the Securities and Exchange Commission for public companies.[2]