A proposed federal cybersecurity rule from the U.S. Cybersecurity and Infrastructure Security Agency would require companies that own and operate critical infrastructure to report covered cyber incidents within 72 hours and payments made after a ransomware attack within 24 hours.
The rule broadly defines critical infrastructure. That means attacks on building systems could easily be deemed within the scope of the rule and real estate owners who lease to covered entities would likely also have to quickly report. The landlords would likely then have to monitor cybersecurity of building software — and perhaps their own internal operations software if that as well could affect the infrastructure.
The rule would apply to any entity in a critical infrastructure area that is either larger than a small business as defined by the Small Business Administration or that fits into one of many categories. Here's a list of some:
- Owns or operates a chemical facility
- Provides wire or radio communications
- Owns or operates critical manufacturing, including metal; machinery; or electrical equipment, appliance, or component
- Transportation equipment manufacturing
- Provides critical support to or processes, stores, or transmits covered information for the Department of Defense
- Performs emergency services, including fire and rescue, law enforcement, emergency medical services, emergency management, or public works that contribute to public health and safety
- Bulk electric and distribution
- Owns or operates financial services sector infrastructure
- Banks, including all national banks, Federal savings institutions, credit unions, commodities or securities trading, Fannie Mae and Freddie Mac, and Federal branches and agencies of foreign banks
- State, local, tribal, or territorial government agencies
- Educational agencies
- Those providing technology to support elections processes
- Essential health-related services
- Information technology entities
- Transportation system agencies
- Owners or operators of qualifying community water systems or publicly owned treatment works
A heck of a list and one that likely includes many tenants of CRE facilities. There are many details as to the information required in reports. All that assumes that the information is tracked, stored, and processed in a way that allows monitoring of cyber conditions and then rapid reporting.
Continue Reading for Free
Register and gain access to:
- Breaking commercial real estate news and analysis, on-site and via our newsletters and custom alerts
- Educational webcasts, white papers, and ebooks from industry thought leaders
- Critical coverage of the property casualty insurance and financial advisory markets on our other ALM sites, PropertyCasualty360 and ThinkAdvisor
*May exclude premium content
Already have an account?
Sign In Now
© 2024 ALM Global, LLC, All Rights Reserved. Request academic re-use from www.copyright.com. All other uses, submit a request to [email protected]. For more information visit Asset & Logo Licensing.
