Eric Geller @ericgeller
But the bill's major provisions remain the same: CISA has 270 days to issue an IFR setting up an incident reporting program, and then 1 year to issue a final rule. CISA has to give companies at least 72 hours to report hacks and at least 24 hours to report ransom payments. — PolitiTweet.org