Policy Briefing — Strengthening American Cybersecurity Act
The Strengthening American Cybersecurity Act bundles FISMA modernization, FedRAMP codification, and critical infrastructure incident reporting, pressing agencies and operators to modernize controls, accelerate zero trust, and overhaul reporting pipelines.
Executive briefing: The U.S. Senate passed the Strengthening American Cybersecurity Act (S.3600) on 1 March 2022, later incorporated into the Consolidated Appropriations Act 2022 and signed into law on 15 March. The package combines three bills: Federal Information Security Modernization Act (FISMA) reform, the Federal Secure Cloud Improvement and Jobs Act codifying FedRAMP, and the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA). Together they mandate faster incident reporting, zero-trust modernization, supply-chain oversight, and streamlined cloud security authorizations. Federal agencies, contractors, and covered critical infrastructure entities must prepare for rulemaking and implementation timelines.
CIRCIA requirements
CIRCIA requires covered critical infrastructure entities to report substantial cyber incidents to CISA within 72 hours and ransomware payments within 24 hours. Covered entities will be defined by forthcoming rulemaking within 24 months, followed by enforcement 18 months later. Reports must include incident description, vulnerabilities exploited, security defenses in place, and mitigation steps. Entities must preserve relevant data and cooperate with CISA during response activities. CISA gains subpoena authority to compel reporting and can refer non-compliant entities to regulators.
FISMA modernization
The Act updates FISMA to emphasize zero-trust architecture, supply-chain risk management, and incident response coordination. It clarifies roles for the Office of Management and Budget (OMB), CISA, and agency CIOs, requiring shared services for cybersecurity and annual risk assessments. Agencies must adopt outcome-based metrics, coordinate with the National Cyber Director, and align with CISA’s Continuous Diagnostics and Mitigation (CDM) program.
FedRAMP codification
The Federal Secure Cloud Improvement and Jobs Act makes FedRAMP permanent, authorizes a Federal Secure Cloud Advisory Committee, and promotes reuse of security authorizations. Agencies must accept FedRAMP authorizations unless they document significant risk. The Act encourages automation, reciprocity, and workforce training to accelerate secure cloud adoption.
Operational priorities
- Incident reporting readiness: Critical infrastructure operators should review incident response plans to ensure they can compile required data within 72 hours. Establish reporting liaisons, legal review processes, and secure submission channels.
- Data retention and forensics: Implement logging and retention policies to preserve evidence for CISA investigations. Ensure systems capture network traffic, endpoint telemetry, and cloud logs.
- Zero-trust implementation: Agencies must align with OMB M-22-09 targets—identity security, device security, network segmentation, application security, and data protection. Contractors should mirror expectations to maintain eligibility.
- Supply-chain oversight: Update vendor risk management to meet FISMA’s enhanced supply-chain provisions. Require SBOMs, vulnerability disclosures, and continuous monitoring.
- FedRAMP strategy: Agencies and cloud providers should streamline authorization packages, adopt automation (e.g., Open Security Controls Assessment Language), and plan for advisory committee engagement.
Governance and compliance actions
- Policy updates: Revise cybersecurity policies to incorporate CIRCIA reporting obligations, zero-trust milestones, and FedRAMP reuse expectations.
- Board and executive engagement: Critical infrastructure boards should understand liability implications and oversight responsibilities. Federal executives must brief agency heads on modernization plans and budget needs.
- Legal coordination: Align with sector-specific regulators (FERC, TSA, HHS) that may enforce incident reporting. Coordinate with legal counsel on privilege, liability protections, and subpoena responses.
- Performance metrics: Develop metrics tracking incident reporting timeliness, zero-trust implementation status, FedRAMP authorization reuse, and supply-chain risk mitigation.
- Stakeholder communication: Engage with industry groups, ISACs, and government councils to share implementation best practices and influence rulemaking.
Technology and data enablers
- Logging infrastructure: Expand log aggregation, SIEM coverage, and long-term storage to meet reporting and investigation requirements.
- Automation: Use security orchestration tools to collect incident data, enrich reports, and automate submission workflows.
- Identity and access management: Strengthen identity governance, multi-factor authentication, and privileged access management to meet zero-trust goals.
- Cloud security posture management: Ensure cloud environments maintain FedRAMP baselines, continuous monitoring, and automated evidence generation.
- Data classification: Classify data to prioritize protection efforts and align with incident reporting thresholds.
Sourcing and partnership considerations
- Contract modifications: Update contracts with integrators, MSSPs, and cloud providers to reflect incident reporting timelines, cooperation requirements, and data retention.
- Vendor due diligence: Assess supplier readiness for zero-trust architectures and FedRAMP requirements. Require attestations and roadmaps.
- Shared services: Explore government-wide services (e.g., CISA cyber services, FedRAMP marketplace tools) to reduce duplication.
- Insurance review: Coordinate with insurers regarding reporting obligations and potential policy impacts from ransomware disclosures.
- Training providers: Engage training vendors to deliver zero-trust, incident reporting, and FedRAMP curriculum.
Implementation roadmap
- 2022: Conduct readiness assessments, update incident response plans, and inventory reporting obligations. Submit comments to CISA’s rulemaking dockets.
- 2023: Implement zero-trust milestones, expand logging, and align FedRAMP reuse policies. Prepare for draft rules and pilot reporting processes.
- 2024 onward: Comply with final CIRCIA rules, report incidents within required timeframes, and maintain continuous improvement cycles for FISMA metrics and FedRAMP automation.
Strategic outlook
The Strengthening American Cybersecurity Act signals a long-term shift toward mandatory incident reporting and coordinated federal cybersecurity. Organizations that invest in automation, zero trust, and supply-chain security will meet regulatory expectations and enhance resilience.
Coordination with other regimes
Organizations should map CIRCIA obligations to existing state and sector requirements, such as New York Department of Financial Services cyber rules, Transportation Security Administration security directives, and energy sector mandatory reliability standards. Harmonizing reporting templates and playbooks will reduce duplication when incidents trigger multiple notifications. Entities operating internationally must also align with EU NIS2 and UK operational resilience rules to avoid conflicting timelines.
Federal contractors should assess how FISMA updates intersect with Cybersecurity Maturity Model Certification (CMMC) requirements and defense industrial base obligations. Shared services and managed providers must prepare to support agency customers with zero-trust milestones, continuous monitoring, and incident reporting under shared responsibility models.
Enforcement expectations
CISA will develop enforcement mechanisms, including subpoenas and coordination with sector risk management agencies. Organizations should rehearse response plans for CISA information requests and maintain clear documentation of incident timelines, cooperation steps, and remediation actions. Proactive engagement with CISA’s Joint Cyber Defense Collaborative can improve threat visibility and demonstrate goodwill during compliance reviews.
Enterprises should document lessons learned from voluntary reporting pilots with CISA to refine communication templates, making it easier to meet binding deadlines once regulations take effect.
Track legislative updates through sector ISAC briefings to adjust compliance roadmaps as CISA clarifies enforcement timelines.
Continue in the Policy pillar
Return to the hub for curated research and deep-dive guides.
Latest guides
-
Semiconductor Industrial Strategy Policy Guide — Zeph Tech
Coordinate CHIPS and Science Act, EU Chips Act, and Defense Production Act programmes with capital planning, compliance, and supplier readiness.
-
Digital Markets Compliance Guide — Zeph Tech
Implement EU Digital Markets Act, EU Digital Services Act, UK Digital Markets, Competition and Consumers Act, and U.S. Sherman Act requirements with cross-functional operating…
-
Export Controls and Sanctions Policy Guide — Zeph Tech
Integrate U.S. Export Control Reform Act, International Emergency Economic Powers Act, and EU Dual-Use Regulation requirements into trade compliance, engineering, and supplier…