CISA Releases Proposed Rules on Breach Reporting Requirements

Hunton Andrews Kurth – On March 27, CISA previewed a notice of proposed rulemaking, which would require covered entities to notify them within 72 hours in the event of a qualifying cyber incident, and within 24 hours for ransomware payments.