US Government Accountability Office GAO

The implementation (…) requires covered entities across critical infrastructure sectors to report “covered cyber incidents” to CISA [Cybersecurity and Infrastructure Security Agency] within 72 hours of reasonably believing that a “covered cyber incident” occurred and ransom payments resulting from a ransomware attack within 24 hours of making payment. According to CISA, it is still developing the rules for such reporting and expects to issue the notice of proposed rulemaking in March 2024 and the final rules by September 2025. If implemented effectively, CISA’s reporting rules could help to provide the federal government more complete and comparable data on ransomware impacts on the nation’s critical infrastructure.

Officials from the critical manufacturing, energy, and transportation systems sectors identified several reasons for not tracking implementation of practices included in the NIST ransomware profile or other practices used to address ransomware. For example, six of the eight (…) stated that they were not familiar with the ransomware profile or did not identify it as one of the adopted sets of practices within the sector.

In addition, officials noted that they lacked mechanisms or resources for tracking implementation of the ransomware profile and other cybersecurity practices they used, did not see it as their role to measure adoption , or that they lacked the regulatory authority to collect such data.

The SRMAs have not fully assessed the effectiveness of their support to sectors in addressing ransomware. Specifically, three of the six selected SRMAs have evaluated aspects of their support and three SRMAs did not demonstrate efforts to evaluate any of their support.