Water, Commercial Companies Face More Urgent Reporting of Hacks

Water utilities, casinos, and shopping malls would have to beef up their cybersecurity operations to comply with hack reporting requirements set to become law as soon this week.

Cybersecurity reporting rules passed in a government funding bill (H.R. 2471) March 10 would encompass a broad range of businesses in 16 critical infrastructure sectors. Companies would have 72 hours to report a hack, and 24 hours to report a ransomware payment to the government, once rules are in place.

A man types on a laptop computer in an arranged photograph taken in Tiskilwa, Ill., in 2015.

Photographer: Daniel Acker/Bloomberg

“A 72-hour reporting requirement is often a challenge for even large and well-resourced organizations,” said Jim McKenney, practice director ...