A group of state election officials is raising concerns about a draft rule that would require election offices to disclose suspected cyberattacks to the federal government. The rule, a result of a 2022 federal law, directs the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to develop regulations mandating certain entities to report potential cybersecurity breaches or ransomware attacks.
Election offices, classified as critical infrastructure alongside banks and power plants, would be required to report suspected breaches within 72 hours under the proposed rule. The National Association of Secretaries of State has requested CISA to consider making the rule voluntary, limiting the information requested, and clearly defining triggering cyber incidents.
