Proposed Cybersecurity Rule Could Affect Many CRE Landlords
The rule would require critical businesses to almost immediately report hacking and ransomware attacks.
A proposed federal cybersecurity rule from the U.S. Cybersecurity and Infrastructure Security Agency would require companies that own and operate critical infrastructure to report covered cyber incidents within 72 hours and payments made after a ransomware attack within 24 hours.
The rule broadly defines critical infrastructure. That means attacks on building systems could easily be deemed within the scope of the rule and real estate owners who lease to covered entities would likely also have to quickly report. The landlords would likely then have to monitor cybersecurity of building software — and perhaps their own internal operations software if that as well could affect the infrastructure.
The rule would apply to any entity in a critical infrastructure area that is either larger than a small business as defined by the Small Business Administration or that fits into one of many categories. Here’s a list of some:
- Owns or operates a chemical facility
- Provides wire or radio communications
- Owns or operates critical manufacturing, including metal; machinery; or electrical equipment, appliance, or component
- Transportation equipment manufacturing
- Provides critical support to or processes, stores, or transmits covered information for the Department of Defense
- Performs emergency services, including fire and rescue, law enforcement, emergency medical services, emergency management, or public works that contribute to public health and safety
- Bulk electric and distribution
- Owns or operates financial services sector infrastructure
- Banks, including all national banks, Federal savings institutions, credit unions, commodities or securities trading, Fannie Mae and Freddie Mac, and Federal branches and agencies of foreign banks
- State, local, tribal, or territorial government agencies
- Educational agencies
- Those providing technology to support elections processes
- Essential health-related services
- Information technology entities
- Transportation system agencies
- Owners or operators of qualifying community water systems or publicly owned treatment works
A heck of a list and one that likely includes many tenants of CRE facilities. There are many details as to the information required in reports. All that assumes that the information is tracked, stored, and processed in a way that allows monitoring of cyber conditions and then rapid reporting.
If there are cyberattacks on a building’s digital systems that could affect the operations of a covered entity, it seems reasonable to assume such attacks would also need to be reported. The landlord of the building would need a capability to perform the monitoring and reporting. It’s a fair guess that many CRE property owners that might be required to provide information are not set up to provide it.