US CIRCIA law will improve cybersecurity long-term

Significance

It empowers the Cybersecurity and Infrastructure Security Agency (CISA) to develop detailed regulations about when and how cybersecurity incidents must be reported to the government. CIRCIA’s intention is to help collect more accurate data on breaches, identify trends and share threat information with the public and private sectors.

Impacts

• CIRCIA will apply more broadly than any previous federal data breach rules, encompassing nearly all critical infrastructure sectors.
• The government will need to incentivise firms to submit detailed information about their security and breach following the initial filing.
• Cybersecurity compliance is a rising cost centre for US firms.