S. 2875 · 117th Congress
Cyber Incident Reporting Act of 2021
Key: what the circles and colors mean
Each circle is a bill. The ring fills as it moves through Congress:
Under the number: the Yea · Nay count of its final (or latest) recorded vote. On a member's page, the small badge is how that member voted: Y Yea / Aye, N Nay / No, P Present, – Not voting.
Gold and violet are only for Yea and Nay; they never mean a party. A member's party is the letter on their photo.
Never voted on. It didn't reach a floor vote before the 117th Congress ended, so it expired. A bill has to be introduced again to be considered in a new Congress.
D
PetersSponsor3 cosponsors · 1 D, 2 R
1 signed on when it was introduced; the rest joined later. Cosponsors who withdrew aren't shown.
This bill requires reporting and other actions to address cybersecurity incidents, including ransomware attacks.
What it does: CRS summary · Reported to Senate · Dec 13, 2022
Cyber Incident Reporting Act of 2021
This bill requires reporting and other actions to address cybersecurity incidents, including ransomware attacks.
Entities that own or operate critical infrastructure must report cyber incidents and ransom payments within specified time frames while other entities may voluntarily report incidents. The Cybersecurity and Infrastructure Security Agency (CISA) must establish an office to receive and analyze such reports.
The bill limits the use and disclosure of reported information. The information may be shared (subject to protections) with federal agencies or to address cybersecurity threats. However, shared information may not be used as a basis for certain regulatory enforcement. Additionally, an entity may not be liable for submitting required reports. Further, reports do not constitute waivers of applicable protections against disclosure (e.g., attorney-client privilege) and are not subject to laws governing release of federal records.
The bill authorizes CISA to take specified action (e.g., issuing subpoenas) if an entity fails to submit a required report. CISA may share subpoenaed information with a regulator or the Department of Justice for regulatory enforcement or criminal prosecution.
A federal agency must share any information it receives about cyber attacks with CISA.
The bill also establishes (1) an interagency council to standardize federal reporting of cybersecurity threats, (2) a task force on ransomware attacks, and (3) a pilot program to identify information systems vulnerable to ransomware attacks.
Written by the nonpartisan Congressional Research Service. All summary versions on Congress.gov
About this bill and sources
Official title: Cyber Incident Reporting Act of 2021
Latest action (Dec 13, 2022): Placed on Senate Legislative Calendar under General Orders. Calendar No. 633.
Policy area: Science, Technology, Communications · Origin: Senate · Introduced: Sep 28, 2021
Official page on Congress.gov · Bill text (GovInfo) · Status record (XML)
No recorded floor vote found.