H.R. 5440 · 117th Congress
Cyber Incident Reporting for Critical Infrastructure Act of 2021
Key: what the circles and colors mean
Each circle is a bill. The ring fills as it moves through Congress:
Under the number: the Yea · Nay count of its final (or latest) recorded vote. On a member's page, the small badge is how that member voted: Y Yea / Aye, N Nay / No, P Present, – Not voting.
Gold and violet are only for Yea and Nay; they never mean a party. A member's party is the letter on their photo.
Never voted on. It didn't reach a floor vote before the 117th Congress ended, so it expired. A bill has to be introduced again to be considered in a new Congress.
D
ClarkeSponsor3 cosponsors · 1 D, 2 R
3 signed on when it was introduced; the rest joined later. Cosponsors who withdrew aren't shown.
C yber Incident Reporting for Critical Infrastructure Act of 2021
What it does: CRS summary · Introduced in House · Sep 30, 2021
Cyber Incident Reporting for Critical Infrastructure Act of 2021
This bill requires reporting and other actions to address cybersecurity incidents, including ransomware attacks.
Entities that own or operate critical infrastructure must report cybersecurity incidents (e.g., ransomware attacks) within specified time frames while other entities may voluntarily report incidents. The Cybersecurity and Infrastructure Security Agency (CISA) must (1) carry out rulemaking to implement the reporting requirements, and (2) establish an office to receive and analyze such reports. To the extent practicable, CISA must align its rules with existing requirements related to the reporting of cybersecurity incidents.
The bill limits the use and disclosure of reported information. The information may be shared (subject to protections and restrictions) with federal agencies or to address cybersecurity threats. However, shared information may not be used as a basis for certain regulatory enforcement. Additionally, an entity may not be liable for submitting required reports. Further, reports are not subject to laws governing release of federal or other governmental records.
The bill authorizes CISA to take specified action (e.g., issuing subpoenas) if an entity fails to submit a required report. CISA may share subpoenaed information with a regulator or the Department of Justice for regulatory enforcement or criminal prosecution.
Written by the nonpartisan Congressional Research Service. All summary versions on Congress.gov
About this bill and sources
Official title: Cyber Incident Reporting for Critical Infrastructure Act of 2021
Latest action (Oct 1, 2021): Referred to the Subcommittee on Cybersecurity, Infrastructure Protection, and Innovation.
Policy area: Science, Technology, Communications · Origin: House · Introduced: Sep 30, 2021
Official page on Congress.gov · Bill text (GovInfo) · Status record (XML)
No recorded floor vote found.