S. 2875: Cyber Incident Reporting Act of 2021

117th Congress

A bill to amend the Homeland Security Act of 2002 to establish the Cyber Incident Review Office in the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security, and for other purposes.

Sponsor: Sen. Gary Peters — D — MI

Requires operators of critical infrastructure (such as utilities providers) to report to the federal government about cyber attacks on their systems and about ransom payments they make to hackers. The bill establishes an office under the Cybersecurity and Infrastructure Security Agency (CISA) to receive and analyze such reports and to inform those operators of the new reporting requirements. The bill also authorizes CISA to fine critical infrastructure operators that fail to report cyber incidents. The bill also expands CISA’s authority to share information about threats of ransomware attacks with federal agencies and nonfederal entities. Ransomware attacks are attacks on information technology systems to extort a ransom payment from victims. In the rare instances when CISA would not be able to identify the owners of computers or devices that are vulnerable to ransomware threats, the bill would authorize the agency to compel Internet service providers (ISPs) to disclose the identity of owners of such technology.

View the full vote history of this bill on GovTrack.us.