Regulation
CIRCIA final rule reaches the White House: get ready now
CISA sent the CIRCIA incident reporting rule to OMB on October 1. What the law already fixes, what is still open, and how to prepare your runbook.
On October 1, 2026 the Cybersecurity and Infrastructure Security Agency (CISA) sent its final rule under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) to the Office of Management and Budget (OMB) for review. The Office of Information and Regulatory Affairs (OIRA), the part of OMB that reviews significant rules, logged it under RIN 1670-AA04 at the final rule stage. The text under review is not public, and nothing in it applies yet. Review can take up to 90 days, though many final rules clear in a few weeks, and attorneys quoted by GovInfoSecurity and HIPAA Journal expect publication by year end.
If your organisation sits in one of the 16 critical infrastructure sectors, from hospitals and water utilities to federal IT suppliers, the rule will likely require you to report a substantial cyber incident to CISA within 72 hours and a ransom payment within 24 hours. Those two deadlines come from the 2022 statute. Who is covered, what a report contains and the start date are still open.
What the law already says
CIRCIA became law in March 2022 and sits at 6 U.S.C. 681 to 681g. Section 681b sets the core duties. A covered entity must report a covered cyber incident "not later than 72 hours after the covered entity reasonably believes" it has occurred, and CISA may not set a shorter deadline. An entity that makes a ransom payment after a ransomware attack must report it within 24 hours of paying, whether or not the attack itself is a covered incident.
The statute also requires prompt supplemental reports when substantial new information emerges, requires the entity to preserve data relevant to the incident or payment, and allows a third party such as an incident response firm or law firm to file on the entity's behalf. Filing through a third party does not move the legal duty off the covered entity.
Enforcement is in section 681d. If CISA believes an entity failed to report, it can send a request for information. With no adequate answer within 72 hours, the Director can issue a subpoena and refer refusal to the Attorney General for a civil action. Reports themselves are protected: exempt from the Freedom of Information Act (FOIA), no waiver of privilege, and no regulatory enforcement based on the report alone.
None of this bites until the final rule takes effect. Section 681b says the reporting duties start "on the dates prescribed in the final rule", as CISA's CIRCIA page confirms. Some online summaries describe the final rule as published in 2025. That is wrong: we found no final rule in the Federal Register, and OIRA's October 1 entry shows it still at the review stage.
What is still draft
Everything else comes from the April 4, 2024 proposed rule, which CISA can change. Wiley's lawyers, writing on October 6, said it "remains unclear how extensively CISA modified the proposed rule."
The proposal defined a covered entity as any organisation in a critical infrastructure sector that is larger than the Small Business Administration (SBA) size standard for its industry, or that meets a sector criterion regardless of size. Examples of sector criteria include owning a large or critical access hospital, running a community water system serving 3,300 or more people, providing IT services to the federal government, or already reporting to the Pentagon under DFARS clause 252.204-7012. CISA estimated the proposal would reach more than 300,000 entities; press reports range from "nearly 300,000" to 316,000.
A "substantial cyber incident" in the proposal is one that causes a substantial loss of confidentiality, integrity or availability, a serious impact on the safety of operational systems, a disruption of the business, or unauthorised access through a compromised cloud, managed service or supply chain provider. It asked for detailed reports (exploited vulnerabilities, tactics, indicators of compromise, and for ransom payments the demand and payment details) and would require preserving logs, forensic images, memory captures and communications with the attacker for two years after the last report.
At CISA's June 2026 town halls, many participants asked for the size test to be dropped. CISA did not commit to that, per Covington's summary, and pointed to supplemental reports when told 72 hours is too short.
The overlap problem
The statute lets an entity skip the CISA report if it already must give substantially similar information to another federal agency in a similar timeframe, but only once CISA and that agency have signed an information sharing agreement. The 2024 proposal named no reporting programme that qualified. Defense contractors already report to the Pentagon within 72 hours under DFARS; one consultant quoted by GovInfoSecurity said he saw no sign of an agreement covering those reports.
In health care, HIPAA breach notices are due within 60 days of discovering a breach of unsecured protected health information, and a CIRCIA report does not satisfy them. The CIRCIA clock starts at a reasonable belief that an incident occurred, so a ransomware outage can start it before anyone knows whether patient data left the building.
National Cyber Director Sean Cairncross told a USTelecom event in September that the rule is meant to harmonise federal incident reporting. A Government Accountability Office report from July 2026 (GAO-26-108606) found that 80 of 117 federal cybersecurity regulations carry reporting requirements, many of them potentially duplicative. Until the final text says otherwise, plan to file with CISA on top of what you file today.
What to do now
Decide whether you are likely covered
Find your NAICS code and check its Small Business Administration (SBA) size standard. Then go through the proposed sector criteria in the 2024 rule, because they apply regardless of size. Record the answer and reasoning, then recheck it against the final text.
Put the 72-hour clock in the runbook
The clock runs from "reasonable belief", not confirmation, so name the person who decides when that point is reached and logs the time. Add a step asking whether the event meets any of the four impact tests above. A ransomware attack that stops operations will meet one in the first hour; a phishing compromise of one mailbox may not.
Preserve evidence from the first hour
Before anyone reimages a host, capture memory and a disk image, export the relevant firewall, VPN, EDR and identity provider logs, and save ransom notes and chat portal transcripts. Check retention now: if your SIEM keeps 90 days of logs, you will not have the history a two-year preservation duty assumes. Keep copies the attacker cannot delete.
Write the ransom payment path
Name who can approve a payment, who checks the payee against Treasury OFAC sanctions lists, and who files the CISA report within 24 hours of the money leaving. If a negotiator or insurer pays for you, the duty to report is still yours, so your contract should say who files and when.
Name who files
Pick the internal owner (often the CISO with legal), a backup, and any third party authorised to file for you. Put CISA alongside your existing notices to HHS, the SEC (Form 8-K within four business days of deciding an incident is material, for listed companies), state regulators and customers, with one owner per deadline. Ask managed service and cloud providers how fast they will tell you about an incident on their side, since a compromise there can be your covered incident.
CISA accepts voluntary reports now at cisa.gov/report. A tabletop exercise run against the 72 and 24 hour deadlines will show which of these steps breaks first.
If you want help mapping your reporting duties or testing your incident runbook, see our compliance and audit readiness and security operations services. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: GovInfoSecurity, Paubox, Wiley, Security.io, HIPAA Journal, Covington (Law360), Federal News Network, Davis Wright Tremaine, 6 U.S.C. 681b, 6 U.S.C. 681d, CISA CIRCIA NPRM overview, CISA CIRCIA FAQs, CRS R48025, GAO-26-108606.