Client Alert: The Cyber Incident Reporting for Critical Infrastructure Act of 2022

On March 15, 2022, President Biden signed into law the “Cyber Incident Reporting for Critical Infrastructure Act of 2022” (the Act) as part of the 2022 federal funding bill.
 
Among other things, the Act requires critical infrastructure sector entities to report cybersecurity breach incidents and ransomware payments to the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA).
 
Key Takeaways
  • The Act covers entities “in a critical infrastructure sector” as further defined by CISA’s final rule.
  • Covered entities must report covered cyber incidents to CISA within 72 hours after reasonably believing a covered incident has occurred.
  • Covered entities must report ransomware payments within 24 hours of making a payment.
  • The Act specifies enforcement authority for CISA and information protection provisions.

Read the full alert here.

Related Capabilities

Related Locations

© 2026 Jenner & Block LLP. Attorney Advertising. Jenner & Block LLP is an Illinois Limited Liability Partnership including professional corporations. This publication, presentation, or event is not intended to provide legal advice but to provide information on legal matters and/or firm news of interest to our clients and colleagues. Readers or attendees should seek specific legal advice before taking any action with respect to matters mentioned in this publication or at this event. The attorney responsible for this communication is Brent E. Kidwell, Jenner & Block LLP, 353 N. Clark Street, Chicago, IL 60654-3456. Prior results do not guarantee a similar outcome. Jenner & Block London LLP, an affiliate of Jenner & Block LLP, is a limited liability partnership established under the laws of the State of Delaware, USA and is authorised and regulated by the Solicitors Regulation Authority with SRA number 615729. Information regarding the data we collect and the rights you have over your data can be found in our Privacy Notice. For further inquiries, please contact dataprotection@jenner.com.

Client Alert: The Cyber Incident Reporting for Critical Infrastructure Act of 2022
On March 15, 2022, President Biden signed into law the “Cyber Incident Reporting for Critical Infrastructure Act of 2022” (the Act) as part of the 2022 federal funding bill.
 
Among other things, the Act requires critical infrastructure sector entities to report cybersecurity breach incidents and ransomware payments to the Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA).
 
Key Takeaways
  • The Act covers entities “in a critical infrastructure sector” as further defined by CISA’s final rule.
  • Covered entities must report covered cyber incidents to CISA within 72 hours after reasonably believing a covered incident has occurred.
  • Covered entities must report ransomware payments within 24 hours of making a payment.
  • The Act specifies enforcement authority for CISA and information protection provisions.

Read the full alert here.

Related Capabilities

Related Locations

© 2026 Jenner & Block LLP. Attorney Advertising. Jenner & Block LLP is an Illinois Limited Liability Partnership including professional corporations. This publication, presentation, or event is not intended to provide legal advice but to provide information on legal matters and/or firm news of interest to our clients and colleagues. Readers or attendees should seek specific legal advice before taking any action with respect to matters mentioned in this publication or at this event. The attorney responsible for this communication is Brent E. Kidwell, Jenner & Block LLP, 353 N. Clark Street, Chicago, IL 60654-3456. Prior results do not guarantee a similar outcome. Jenner & Block London LLP, an affiliate of Jenner & Block LLP, is a limited liability partnership established under the laws of the State of Delaware, USA and is authorised and regulated by the Solicitors Regulation Authority with SRA number 615729. Information regarding the data we collect and the rights you have over your data can be found in our Privacy Notice. For further inquiries, please contact dataprotection@jenner.com.

News and Insights

Event

Associate Steven Arango to Speak at the Veterans' Legal Career Fair

On September 18, Associate Steven Arango will speak on a panel at the Veterans' Legal Career Fair (VLCF), the only legal career fair in the United States dedicated to veterans, active-duty service members, and military spouses.

September 18, 2026

Event

Partner David Greenwald to Speak at PLI Program on Privilege and AI

On August 17, David Greenwald will speak at "Fitting New “Tech” Into the Attorney-Client Privilege and Work Product Protection," a virtual program hosted by the Practising Law Institute (PLI).

August 17, 2026

Publications

In Law360, Trump Debarment Threat Calls for Targeted Defense Plan

Partners Ashley Callen and David Robbins authored an article for Law360 examining how entities should respond when suspension or debarment is threatened directly by the president, rather than initiated through the usual agency-driven process.

August 6, 2026

Publications

"DC Circuit Undercuts Congress's Subpoena Power: Important New Authority for Targets of Congressional Investigations," National Law Journal

In the National Law Journal, Congressional Investigations Co-Chair Emily Loeb, Special Counsel David Manners-Weber, and Associate Kate Mather examine a recent DC Circuit decision that gives fresh weight to 2020 Supreme Court dicta on common-law privileges in congressional investigations.

July 30, 2026