Outlook for 2024: CISA incident reporting rulemaking, NIST cyber framework update and CMMC program launch

Details on the Cybersecurity and Infrastructure Security Agency’s incident reporting regulation will be revealed in the new year, along with the rollout of a major update to the NIST cybersecurity framework and upcoming cyber procurement requirements for civilian agencies and the Defense Department.

The 2022 Cyber Incident Reporting for Critical Infrastructure Act directs CISA to develop an incident reporting regime for critical infrastructure where “covered” entities will be required to submit reports on “covered” incidents within 24 hours. CISA...