CMMC issues. CISA's forthcoming incident reporting rules. US FTC blogs policy.

Summary

By the CyberWire staff

At a glance.

CMMC issues.
CISA's forthcoming incident reporting rules.
US FTC blogs policy.

Small US Government contractors struggle with the CMMC.

README discusses the US Cybersecurity Maturity Model Certification program (CMMC), and the challenges it poses for small defense contractors. The program means that approximately 80,000 companies that sell to the US military will need to pass a cybersecurity audit before they can bid for business, and many are not prepared for the red tape and steep costs the complying with CMMC will likely involve. Michael Dunbar, president of a small fuel and lubricant company that works with the DOD, said of the new requirements, “We were going to have to be compliant with this stuff, but they just kept using all these different acronyms, and I had no idea what anything meant.”

At first stalled by a flurry of criticism from industry advocates who felt the program was unnecessarily complicated and restrictive, the CMMC was overhauled by the Biden administration at the end of 2021. Under CMMC 2.0, about the majority of defense contractors, will be defined as being in “CMMC level one,” where the only requirement will be a self-assessment. However, even a self-assessment is likely to be too overwhelming for smaller subcontractors like Dunbar who are ill-equipped to navigate the level of cybersecurity knowledge the CMMC requires. And for level two firms, the cost of required compliance assessments could be crippling.

What to expect from CISA’s incident reporting rules.

When the US Congress passed the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) in March, the Cybersecurity & Infrastructure Security Agency (CISA) was given two years to develop the proposed rules. While CISA has not yet finalized CIRCIA, on April 7 the agency provided stakeholders with guidance about cyberincident reporting, and JDSupra offers an overview of CISA’s priorities. The guidance outlines what to share, who should share, and how to share information about unusual cyberactivities. CISA has three mechanisms for sharing cyber event information: completing an incident report form in the CISA Incident Reporting System, emailing Reports@cisa.gov, or sending details about phishing operations to Phishing-report@us-cert.gov. Though CISA has two years to finalize the rules, it is anticipated that they will issue additional guidance in an NRPM in advance of that date.

Informal breach reporting guidance from the FTC.

Staying on the topic of incident reporting requirements, last week the Federal Trade Commission’s (FTC) Team CTO and the Division of Privacy and Identity Protection published a blog post stressing the importance of breach disclosures. Despite the fact that there is currently no section of the Federal Trade Commission Act that imposes an EXPRESS data breach notification requirement, the FTC indicates that in some cases there could be a de facto data breach notification requirement, and encourages businesses to take this into account when designing their incident response plans. In fact, the post states, "Regardless of whether a breach notification law applies, a breached entity that fails to disclose information to help parties mitigate reasonably foreseeable harm may violate Section 5 of the FTC Act." As the National Law Review explains, the post goes on to describe recent real-life incidents in which reporting failures were deemed unfair or deceptive trade practice and led to enforcement actions.

Selected Reading

Japan-U.S. Joint Leaders’ Statement: Strengthening the Free and Open International Order (The White House) Today, Japan and the United States affirm a partnership that is stronger and deeper than at any time in its history. Guided by our shared values; anchored

The Era of Borderless Data Is Ending (New York Times) Nations are accelerating efforts to control data produced within their perimeters, disrupting the flow of what has become a kind of digital currency.

How GDPR Is Failing (Wired) The world-leading data law changed how companies work. But four years on, there’s a lag on cleaning up Big Tech.

Steep costs, troubling questions roil DOD cybersecurity program rollout (Medium) About 80,000 companies that sell to the U.S. military will need to pass a cybersecurity audit before they can bid for business under rules…

CISA Signals Cyber Incident Reporting Requirements (JD Supra) In March 2022, Congress passed the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) requiring critical infrastructure to...

How Far Have We Come Against Ransomware in the Past Year? (GovTech) One year after the Colonial Pipeline hack — and the IST Ransomware Task Force's report — attacks remain frequent. But the government is making strides and recognizing the issue as a national security matter.

Use of Cryptocurrency in Ransomware Attacks, Available Data, and National Security Concerns (US Senate Committee on Homeland Security and Gevernmental Affairs) Ransomware is a dangerous form of cyber-attack where threat actors prevent access to computer systems or threaten to release data unless a ransom is paid. It has the power to bankrupt businesses and cripple critical infrastructure – posing a grave threat to our national and economic security. The use of cryptocurrencies has further enabled ransomware attacks, particularly because cryptocurrency is decentralized and distributed and illicit actors can take steps to obscure transactions and make them more difficult to track.

FTC Blog: “The FTC Act Creates a De Facto Breach Disclosure Requirement” (The National Law Review) On May 20, 2022, the Federal Trade Commission&rsquo;s Team CTO and the Division of Privacy and Identity Protection published a blog post entitled, &ldquo;Security Beyond Prevention: The Importance of

US Army Seeks to Grow 'Cyber Warrior Force' (The Defense Post) As cyber attacks increase, the US Army is looking to increase its force of “cyber warriors” to guard against these threats.