Strengthen Critical Infrastructure Cybersecurity

Summary#

The Securing Our Critical Infrastructure Act would amend the Cyber Incident Reporting for Critical Infrastructure Act of 2022; it is not yet law. It would turn a CISA vulnerability-warning pilot focused on ransomware into a broader security vulnerability warning program and add services for covered utilities. The stated goal is to strengthen cybersecurity support for those utilities.

  • CISA’s Director would automatically enroll each covered utility in applicable CISA cyber hygiene services; a utility could leave by notifying the Director.
  • If the Director determines a covered utility has been affected by a cyber incident, the Director must use CISA’s incident-response capabilities to respond on the utility’s behalf, as appropriate.
  • CISA would have to coordinate with the Environmental Protection Agency.
  • “Covered utility” includes a water or wastewater utility serving no more than 100,000 people, certain entities defined in another law, and operators of public water systems or treatment works.
  • Information shared by a covered utility would be exempt from specified federal, state, local, and Tribal public-disclosure laws. The Director could disclose, retain, or use it only for purposes allowed by a cross-referenced law, and must protect personal and identifying information from unauthorized use or disclosure.
  • The program would end five years after this bill’s enactment. The bill has been referred to the House Committee on Homeland Security; whether it will pass is uncertain.

What it means for you#

  • Covered utilities: If enacted, they would be enrolled in applicable CISA cyber hygiene services automatically, but could disenroll by giving notice. If the Director determines one has been affected by a cyber incident, CISA must provide an appropriate response on its behalf.
  • CISA: The Director would have to run the program, arrange automatic enrollment, provide incident response when the stated condition is met, and coordinate with EPA.
  • People served by utilities: The bill does not directly change utility service, customer rights, or customer bills. It aims to provide cybersecurity support to covered utilities.
  • People whose information is shared: The bill would limit the Director’s use, retention, and disclosure of covered-utility information and require protection of personal and identifying information. It does not describe how a person could challenge a disclosure or seek a remedy.
  • The public: Some information shared with the program would be exempt from public-records disclosure laws.

Money#

No cost information is in the available material.

  • The bill requires CISA to enroll covered utilities and, in qualifying cases, use its incident-response capabilities. It gives no estimate for staffing, service, or other costs.
  • It does not provide a specific appropriation, fee, or fine.

What is unclear#

  • The Cyber Incident Reporting for Critical Infrastructure Act of 2022 was not supplied, so I could not verify the existing program’s full rules, duties, or how the amended text would interact with current law.
  • The bill does not explain which cyber hygiene services are “applicable,” or what those services include.
  • It does not set out how the Director determines that a utility was affected, how quickly CISA must respond, or what “as appropriate” requires.
  • The meaning of “eligible entity” depends on another law not supplied here. The bill also does not explain how overlapping categories of covered utility would be handled.
  • The permitted purposes for using, retaining, or disclosing information are defined by a cross-reference to another law not supplied here.

Case for#

  • The bill appears intended to extend vulnerability warnings beyond ransomware and offer cybersecurity support to water and wastewater utilities.
  • Automatic enrollment could connect covered utilities to CISA services without requiring each one to apply first; utilities could still opt out.
  • Requiring CISA to respond when it determines a covered utility has been affected could provide direct help during a cyber incident.
  • Limits on information use and disclosure, along with privacy protections, could make information-sharing more secure.

Case against#

  • Automatic enrollment may create work for utilities and CISA, but the bill does not specify service levels, staffing, or funding.
  • The bill leaves key response details to the Director, including how an affected utility is identified and what response is appropriate.
  • Exempting shared information from public-disclosure laws may reduce public access to information about the program; the bill does not describe other public reporting or oversight.
  • The program ends after five years, and the bill does not explain what happens to services or information-sharing arrangements after that.