Why Report Cyber Incidents Anyway?

Cyber incident reporting is among the most burdensome and disharmonized of all regulations.

By the federal government’s own reckoning, there are “13 separate forms and 10 websites in use by the Federal Government for incident reporting. Of the 22 Federal agencies with current cyber incident reporting requirements, only three recognize or accept another agency’s form.” This does not even count reporting data breaches to every state with citizens affected or reporting requirements to other countries, such as the European Union’s NIS2 directive or India’s especially onerous rule to be notified within just six hours.

Attempts to harmonize these competing reporting requirements will never succeed until governments better understand their own information needs: the public policy purposes for which government believes it needs a report in the first place. What actions and decisions is such information supposed to drive? These drive the timelines of any report and what information fields need to be in them.

Take three examples: Sometimes governments need information within minutes or hours to deal with immediate, cascading crises, such as during the ransomware-linked outage of Colonial Pipeline. That is a very different public policy purpose from needing to inform investors about incidents. With no threat to life or national security, just investor money, the U.S. Securities and Exchange Commission (SEC) has a more relaxed timeline, requiring publicly traded companies to report “material impacts” within four days. Lastly, the government also wants information on the effectiveness of cybersecurity controls, or general cybersecurity trends; such reports might be delayed weeks or months, and still be effective.

Harmonizing reports for such widely different purposes can undermine the public policy purpose that required the information in the first place. But because there has not been a framework of such purposes, this has not been an easy task.

Accordingly, this article proposes a decision-support framework of information needs, with example information fields and reporting timelines, to ensure that harmonized reports still meet regulators’ information needs.

Regulators and Information Needs

In open societies like the United States, governments generally use regulation only as a tool to close a specific market failure, which are not just the classic Adam Smith-defined inefficiencies defined by college economics courses. As Joseph Stiglitz explained, “Even when markets are efficient, they may fail to deliver socially desirable outcomes. … Governments impose regulations to prevent [socially unjust and unacceptable] exploitation and to pursue a number of other social goals.” 

Some of cybersecurity’s most persistent market failures are varieties of information asymmetries, the uneven distribution of information between parties. In particular, there are asymmetries involving companies and customers (which can be solved by consumer labeling), between companies and investors (thus the SEC requirement), and between companies and other organizations and government (the goal of most other cyber reporting).

That is, the SEC does not itself need the information in any report; the public policy purpose is to inform a particular set of third parties—investors or potential investors in the affected company—so that they can invest wisely. The goal of government-mandated consumer labeling is to close an information asymmetry with another set of third parties, consumers, so that they can purchase wisely. The goal of most government-mandated reporting is to inform government entities itself, so that it can govern wisely.

Governing wisely, though, covers a wide range of actual public policy purposes driven by unrelated information asymmetries. For example, the best known reporting requirement in the U.S. is the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), passed by Congress in 2022. The Cybersecurity and Infrastructure Security Agency (CISA) is close to finalizing CIRCIA’s reporting rules, a process complicated by the wide range of covered purposes. Rather than rolling out requirements for only one or two purposes at a time, CISA’s Notice of Proposed Rulemaking (NPRM) launches reports to satisfy six widely varying purposes:

• “[T]rend and threat analysis (i.e., the performance of cybersecurity threat and incident trend analysis and tracking …)[.]”
• “[V]ulnerability and mitigation assessment (i.e., the identification of cyber vulnerabilities and the assessment of countermeasures …)[.]”
• “[T]he provision of early warnings (i.e., the rapid sharing of information on cyber threats, vulnerabilities, and countermeasures …)[.]”
• “[I]ncident response and mitigation (i.e., rapid identification of significant cybersecurity incidents and offering of assistance …)[.]”
• “[S]upporting Federal efforts to disrupt threat actors; and advancing cyber resiliency[.]”
• “[F]acilitating use of cyber incident data to further cybersecurity research … on vulnerabilities and how to close them.”

CIRCIA rules, like all regulations, should be tailored to specific public policy needs, especially since they are backed by the coercive power of government. Failing to report covered incidents can result in civil subpoenas and fines.

Reporting timelines should accordingly be tightly aligned with the decisions for which such information is required. This list includes information needs that are highly time sensitive, such as early warning or incident mitigation, which can require notification in anywhere from minutes to days, depending on particulars. Other information needs are far more relaxed, such as trend and threat analysis or vulnerability and mitigation assessment, for which weeks or months might suffice.

Indeed, it is not even clear why the government must mandate, under threat of penalty, that covered entities should report for purposes like trend analysis or vulnerability mitigation. Every mature cybersecurity organization needs such information and can simply buy it from a number of reputable vendors. Regulating for these purposes is perhaps less about closing an information asymmetry than about simply being cheap.

Moreover, despite CIRCIA’s having such an expansive set of purposes, it misses other important asymmetries. CISA might have used the wide authorities of CIRCIA to demand faster reporting of any suspected activity in the midst of geopolitical crises, such as a Chinese invasion or blockade of Taiwan, which might blow back against U.S. critical infrastructure. As CISA learned after the full-scale Russia invasion of Ukraine in 2022, to respond to such geopolitical events the government needs a surge of reporting to guide efforts to put “Shields Up” across government and vulnerable infrastructure.

Framework of Cyber Reporting Purposes

Better regulations first need the government to be clear about their own information needs and certain that mandatory reporting is the most efficient way to meet those needs. Only then should they develop the needed timelines and information fields.

The following decision-support framework provides more structure to guide decisions. While it may seem extensive, if would-be regulators are not considering such details, they are not ready to issue NPRMs and should not be regulating.

There are three broad categories of information asymmetries: (a) government knowledge of incidents, (b) government knowledge of threats and vulnerabilities, and (c) key stakeholder knowledge of those things.

Government knowledge of incidents. There are at least five different kinds of reports that governments might need to inform them of incidents, with greatly varying timelines.

Initial alert to disruption to critical functions, such as life and safety.

During disruptions, such as the ransomware of Change Healthcare and Colonial Pipeline, policymakers need information quickly so that they can assess likely impacts. These incidents either are, or are expected to be declared, significant cyber incidents, which is the trigger for substantial government response.

Accordingly, all levels of government have two strong information needs: to understand the potential impact on national and economic security and the safety of the population and any requirements to possibly provide government assistance. Reports may be needed very quickly, in minutes or hours, including fields like the ongoing impact, expected duration, and any requests for assistance.

Initial alert to other significant cyber events.

Not all significant cyber incidents are likely to be so fast-moving and disrupt life-safety systems. For example, the Russian supply chain attack on SolarWinds led to a massive federal response. But, being espionage, there simply was not the same threat to life and safety.

Though the information needs were broadly the same—to understand impact and determine if victims needed support, the timeline could be more relaxed, from hours to days, unless there was a significant geopolitical crisis (such as in the East China Sea, which might require tighter reporting requirements, see below).

Follow-up notification on significant cyber events.

For any significant cyber incident, governments will need follow-up reports. Again, the information needs remain the same (impact and assistance), but reporting timelines are slightly more relaxed, hours for fast-moving disruptions of life-safety systems or days or even weeks for slower moving incidents. 

Notification of ransom payment.

Governments have increasingly wanted to know whether victims of ransomware attacks are indeed paying ransom, both to understand the scale of the issue and perhaps to block or recover such payments. Such reporting may have very tight timelines (hours or days) if the information need is to drive possible law enforcement action to recover a ransom payment. If, however, the information need is simply to catalog overall trends and statistics and guide future policies (such as whether to ban ransomware payments entirely), then weeks or months are more suitable deadlines.

Understand other incidents.

Lastly, governments may want to catalog overall trends and statistics of incidents in their jurisdiction, to better guide future policies. There need be no rush for such reports, and a deadline of weeks or months is likely sufficient.

Government knowledge of threats and vulnerabilities. In addition to understanding incidents, governments also have information needs about vulnerabilities and threat actors.

Early warning of threat actors targeting critical infrastructure.

A small number of elite companies track cyber threat actors and may come across information that they intend to target critical infrastructure companies. Governments might require reporting of such information, with exceptionally tight timelines, in order to provide a larger warning to potentially affected sectors and to steer their own offensive cyber operations to surveil the operation or disrupt it. In general, though, mandating any reports from threat intelligence companies makes for poor policy, compared to simply purchasing it or building trusted relationships.

Tracking activity of adversaries, during geopolitical crises.

Immediately after Russia launched its full-scale invasion of Ukraine in 2022, CISA started a campaign to convince companies to put the “Shields Up” and quickly improve defenses. During such geopolitical crises—such as a Chinese blockade or invasion of Taiwan—the federal government would have an information need for regular updates of threat actors to complement its own, classified sources, to understand if threat actors were beginning to ramp up attacks against the United States. These would have short timelines to possibly feed decisions about war and peace.

Early warning of new vulnerabilities or tactics, techniques, and procedures (TTPs).

There may likewise be short reporting timelines for any new, critical vulnerabilities or if adversaries shifted to dangerous new TTPs. Most vulnerabilities and changes to TTPs are routine; however, some, such as the Heartbleed or PHP vulnerabilities, lead to massive government response. These happen uncommonly enough and through informal trust networks. Mandatory reporting should be avoided.

General tracking of adversary activity.

Governments also have information needs to track patterns of operational threat activity: Into what systems are they intruding? This can change by the hour or day, and so is a poor fit for mandatory reporting. Rather, governments can sign contracts to purchase such information or join one of the many informal trust networks through which such information is passed.

General threat knowledge for overall trends, statistics

As with trend information for incidents, gathering statistics is not usually an emergency activity. Any policy choices are far off, so requiring reports in weeks is typically sufficient, though again mandating reports from threat intelligence companies is generally a poor policy choice.

Key stakeholders: customers, investors, and the supply chain. The last major category covers the information needs of other stakeholders, in whose interest the government may require mandatory reports.

Notify investors of incident material impact.

The classic example of government mandating reports for other stakeholders is the SEC rule to report a material cyber incident, so that all investors have equal access to that information. Given speeds of markets, the SEC mandates reports within four days, the standard for reporting any material incident, not just cyber.

Initial alert of significant cyber incident to others in the same sector (or other key stakeholders).

In 2023, a major participant in the market for U.S. treasuries was hit by a ransomware disruption, with concerns the attack could spread directly to other, interconnected market participants or indirectly impact the market in which $900 billion changes hands daily. Yet telling other market participants is usually only a requirement of contracts or operational agreements, not mandatory regulation.

Many critical infrastructure sectors have similar needs for such emergency information—in minutes or hours—especially sectors that are highly interconnected and interdependent. This article does not claim this requires new regulation, just that there is an information need. In sectors like finance, structures like information sharing and analysis centers can satisfy this need. In other sectors, this unmet need might mean an actual market failure.

Notify the supply chain of companies experiencing a major disruption.

Likewise, companies up and down an affected company’s supply chain have an information need to understand the nature and duration of any disruption. Research by economists associated with the Federal Reserve system found that, after Russia’s NotPetya attack of 2017, there was a substantial shock on the downstream supply chain to customers of affected firms, especially those that had few alternatives.

Again, this is not an area well covered by regulation. The EU’s NIS2 requires reporting to the government when there is an incident affecting a covered entity’s own supply chain, but only if that would affect the covered entity itself. The goal is to satisfy the information needs of the regulators, not those in the supply chain itself. As above, just because there is a valid need does not mean there is necessarily a market failure requiring regulation.

Follow-up notification of significant cyber events.

Of course, during a major incident, follow-on reports are usually required, with timelines of hours or days, depending on the impact.

These factors are summarized in Table 1.

Table 1. Summary of reporting timelines.

Toward Better Information Reporting Requirements

Regulators have valid information needs, which in turn require mandatory reporting. But the existing reporting regulations are generally too wide reaching, poorly connected to policymaker decisions, or duplicative of information that might be gained through channels other than regulation.

A decision support tool like the framework described in this article will also help harmonization efforts. Regulations intended to close different information needs for different public purposes likely need not be so tightly harmonized. Those intended to address an identical information need should have nearly identical timelines and other requirements.

Regulators should have such a decision support tool in front of them, so that they can consider a wide range of information needs and select which their regulation is trying to solve. Much of the information that regulators say they need is often available from other sources than mandatory reporting. Would-be regulators should then look to see if the requirement can be met through nonregulatory measures—such as just taking out a credit card to buy it. Only then should they decide on regulations, assign an appropriate timeline, and fine-tune information fields.

During an incident, security teams have far more important things to do than deal with bad and disharmonized reporting regulations. Frameworks like this one can help.