CISA to Finalize CIRCIA Cyber Incident Reporting Rule

Executive Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is poised to issue its final rule for the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) in September 2026. This regulation represents a major shift in U.S. cybersecurity policy, establishing mandatory reporting requirements for organizations within the 16 designated critical infrastructure sectors. Under the new rule, covered entities will be legally obligated to report "substantial cyber incidents" to CISA within 72 hours and any ransom payments within 24 hours. The finalization of this rule requires organizations to ensure their incident response plans and technical capabilities are prepared to meet these compressed timelines.

Regulatory Details

CIRCIA was signed into law in March 2022 to provide CISA with the necessary data to understand the national cybersecurity threat landscape, identify trends, and share timely threat intelligence with the broader community. The core tenets of the regulation are:

• 72-Hour Incident Reporting: Covered entities must report any "substantial cyber incident" to CISA no later than 72 hours after the organization reasonably believes an incident has occurred.
• 24-Hour Ransom Payment Reporting: Any entity that makes a ransom payment as a result of a ransomware attack must report the payment to CISA within 24 hours.

The final rule, expected in September 2026, will provide specific definitions for what constitutes a "covered entity" and a "substantial cyber incident," as well as details on the form and content of the required reports.

Affected Organizations

The CIRCIA regulation will apply to organizations operating within the 16 critical infrastructure sectors as defined by Presidential Policy Directive 21 (PPD-21). These sectors include:

• Chemical
• Commercial Facilities
• Communications
• Critical Manufacturing
• Dams
• Defense Industrial Base
• Emergency Services
• Energy
• Financial Services
• Food and Agriculture
• Government Facilities
• Healthcare and Public Health
• Information Technology
• Nuclear Reactors, Materials, and Waste
• Transportation Systems
• Water and Wastewater Systems

The final rule will clarify size thresholds and other criteria for determining exactly which entities within these sectors must comply.

Compliance Requirements

To comply with CIRCIA, affected organizations will need to:

1. Develop and maintain processes to promptly identify and assess cyber incidents to determine if they meet the "substantial" threshold.
2. Establish clear internal procedures for gathering the required information and submitting reports to CISA via its designated portal within the 72-hour and 24-hour deadlines.
3. Preserve data and records related to the reported incident and/or ransom payment.
4. Respond to requests for information from CISA following a report.

Implementation Timeline

• March 2022: CIRCIA signed into law.
• July 2026: Unified Agenda of Federal Regulatory Actions indicates a target date of September 2026 for the final rule.
• September 2026: Expected issuance of the final rule by CISA.

Once the final rule is published, there will be a subsequent period before it becomes fully enforceable, allowing organizations time to make final adjustments.

Impact Assessment

The compressed reporting timelines under CIRCIA will present a significant operational challenge for many organizations. The 72-hour window requires a highly efficient incident response process, from initial detection and triage to technical analysis, legal review, and executive decision-making. This necessitates having mature security operations capabilities, including robust logging, EDR/SIEM solutions, and a well-practiced incident response plan. Failure to comply could result in enforcement actions and penalties, although the primary goal of the regulation is to improve national cybersecurity posture, not to be punitive.

Compliance Guidance

Organizations within the critical infrastructure sectors should take the following steps to prepare:

1. Review Incident Response Plans: Update IR plans to explicitly include the CIRCIA reporting requirements, timelines, and responsible parties.
2. Conduct Tabletop Exercises: Run simulation exercises based on scenarios that would trigger CIRCIA reporting to test and refine your response process under time pressure.
3. Enhance Technical Visibility: Ensure you have adequate logging and monitoring across your IT and OT environments to quickly detect and investigate potential incidents.
4. Legal and Executive Alignment: Brief legal counsel and executive leadership on the new requirements to ensure a smooth and rapid approval process for reporting.