Topic · circia

CIRCIA

Cyber Incident Reporting for Critical Infrastructure Act — the mandatory incident-reporting rule CISA is implementing. Use for the rule itself; pair with incident-response for reporting mechanics.

RSS feed ↗

trade-press
GAO third panel finds CIRCIA and SEC rules conflict with sector regs
After two rounds of industry feedback, the picture isn't improving: energy, financial, and healthcare participants say reporting thresholds, timelines, and definitions across federal rules can't all be met.
GAO's third industry panel report, delivered September 28 to Senators Peters and Garbarino, documents conflicts between CISA's proposed CIRCIA rule, the SEC's 2023 cyber disclosure rules, and sector-specific regulations, NERC-CIP, TSA pipeline requirements, HIPAA, the Bank Secrecy Act, and others. Participants from energy, financial services, and healthcare and public health each described reporting thresholds, timelines, and definitions that diverge across the rules they're subject to. Most participants said federal harmonization progress over the past year has been limited. The panel floated establishing a single entity with authority over regulatory consistency.
SAT
trade-press
CIRCIA Final Rule Expected This Month, Scope Still Open
The harder problem isn't the 72-hour incident clock or the 24-hour ransomware window, it's stacking those deadlines on top of DFARS, NERC, TSA, and DOE reporting obligations that already exist and don't line up.
CISA expects to issue the final CIRCIA rule in September 2026, triggering 72-hour incident and 24-hour ransomware-payment reporting for entities across 16 critical infrastructure sectors by late 2026 or early 2027. The proposed rule estimated over 300,000 covered entities, a scope industry has challenged as too broad and untethered from functional criticality. The final rule's treatment of "covered entity" and "substantial cyber incident" threshold language hasn't been disclosed. For defense contractors, energy operators, and others already subject to sector-specific incident-reporting rules, the operational lift isn't CIRCIA alone, it's building a workflow that doesn't produce conflicting narratives or missed deadlines when multiple regulators want different things on different clocks.
SEP 16
trade-press
CISA rulemaking lead draws line between duplication and overlap
Clagett's definitions matter: overlap is legitimate agencies needing the same incident data for different missions; duplication is what harmonization targets.
CISA's CIRCIA rulemaking lead Nichole Clagett laid out a framework for distinguishing duplication from overlap in cyber incident reporting regulations, telling a Billington Cybersecurity Summit panel that legacy all-hazards rules where cyber reporting "wasn't the original purpose" are potential harmonization targets. The final rule has not entered OMB interagency review. Acting Director Nick Andersen said the day before that timing remains "a work in progress" with more information "very soon."
SEP 11
trade-press
Water Cyber Shield Act Gives EPA $300M for Water Utility Cyber Rules
The bill bakes state flexibility and industry consultation into its design, answering the litigation that killed the Biden EPA's 2023 regulatory push.
Sens. Schiff and Klobuchar introduced the Water Cyber Shield Act, which would authorize $300 million annually from Drinking Water and Clean Water State Revolving Funds for EPA-led cybersecurity assessments, corrective-action mandates, and CIRCIA incident reporting at water and wastewater utilities. Systems would be tiered by size, with states deciding whether to self-regulate or let the EPA step in. It's the second major federal attempt to regulate water-sector cybersecurity after the Biden EPA's effort was sued and abandoned, and its drafters consulted those same groups to head off a repeat.
AUG 10
trade-press
OT coalition urges ISA/IEC 62443 as unified ICS standard
CIRCIA's harmonization exception lets entities skip duplicate reporting, but without a shared OT baseline to measure "substantially similar" against, the exception can't deliver what it promises.
The Operational Technology Cybersecurity Coalition released a July 23 position paper urging federal policymakers to adopt ISA/IEC 62443 as a single horizontal standard for industrial control system security. Operators currently navigate overlapping mandates (the paper cites TSA pipeline security directives and NERC Critical Infrastructure Protection standards as examples) with no shared technical baseline across sectors. Coalition executive director Tatyana Bolton told Inside Cybersecurity that CIRCIA's proposed harmonization exception, which lets entities skip duplicate reporting under a "substantially similar" framework, can't function cleanly for OT until regulators agree on a common standard to measure similarity against.
JUL 24
trade-press
CIRCIA transcripts show industry united against 300,000-entity scope
After two missed deadlines and four town halls of industry pushback, CISA still hasn't signaled what it will change in the CIRCIA rule or whether September is realistic.
CISA published transcripts from four June town halls on its CIRCIA incident reporting rule, and industry's message was near-universal: the proposed scope, covering an estimated 300,000 entities, is too broad and the reporting triggers too sensitive. The data collection demands drew separate objections. The rule has missed two deadlines. The administration now targets September, but multiple industry sources consider that unlikely, and CISA hasn't signaled what feedback it'll act on.
JUL 24
trade-press
GAO finds 80 federal cyber reporting rules duplicate others
Federal harmonization keeps discovering the same problem while operators still have to file under agency-specific rules.
The Government Accountability Office (GAO) identified 80 of 117 federal cybersecurity reporting rules at 37 agencies as duplicative, covering written reports on incidents, plans and reviews. Critical infrastructure operators, primes, subs, contractors and Certified Third-Party Assessment Organizations (C3PAOs) still have to map agency-specific triggers, with pending Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) obligations adding another lane for covered entities. The harmonization work Biden elevated has stalled under a Trump administration pause, making duplication look structural rather than merely partisan.
JUL 22
trade-press
CTIA presses CISA to narrow CIRCIA incident threshold
CIRCIA’s scope fight is where a reporting program becomes an incident-response tax for carriers and contractors.
CTIA filed June 23 comments urging CISA to define “substantial cyber incident” through a harm-based threshold tied to national security, the U.S. economy, or public health and safety, plus a function-specific covered-entity test. Telecom carriers and their primes, MSPs, and contractors are trying to keep noncritical service disruptions out of CIRCIA reporting. The filing exposes the rulemaking’s live fight: overreporting is not free when responders are still inside the incident.
JUL 20
trade-press
HackerOne urges CISA to exempt unsolicited good-faith research from CIRCIA
The legal uncertainty lands on disclosure recipients first, a bad design choice for a rule built to collect useful reports.
HackerOne asked the Cybersecurity and Infrastructure Security Agency (CISA) to revise its Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule so unsolicited good-faith security research is excluded from reportable covered cyber incidents. Inside Cybersecurity reports the June 24 filing followed CISA’s June town halls. The uncertainty matters for primes, managed service providers, state chief information security officers and government operators handling vulnerability tips: a reporting rule meant to improve visibility could turn benign disclosures into compliance events.
JUL 17
trade-press
USTelecom asks CISA to centralize CIRCIA incident reporting
The proposal treats harmonization as architecture, not aspiration, which is exactly where fragmented federal reporting usually fails practitioners.
USTelecom urged the Cybersecurity and Infrastructure Security Agency to create a federal clearinghouse for cyber incident reporting as CISA prepares final Cyber Incident Reporting for Critical Infrastructure Act rules expected in September. The filing calls for a searchable federal requirements site, a common reporting format and a single submission point. Contractors, primes, subs and managed service providers would be the practical beneficiaries if CISA can turn agency-by-agency reporting into one usable intake path.
JUL 16
trade-press
CISA slips CIRCIA final rule to September 2026
Lawmakers may tolerate the delay, but operators still lack the scope, thresholds and procedures they need to build reporting processes.
The Cybersecurity and Infrastructure Security Agency (CISA) now expects to publish the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) final rule in September 2026, Inside Cybersecurity reports, four months after its May target and after CISA missed the law’s original timeline. Critical infrastructure contractors, primes, CMMC third-party assessors and government customers still lack final scope, thresholds and procedures for 72-hour incident reports and 24-hour ransom-payment reports. Congress has shifted to auditing CISA’s process after the schedule fight was already lost.
JUL 9
trade-press
Coast Guard readies foreign-vessel cyber rule for November 2026
The proposal extends the maritime cyber mandate while testing whether inspectors have enough technical depth to enforce it.
The Coast Guard plans a November 2026 proposed rule setting minimum cybersecurity requirements for foreign-flagged vessels operating in U.S. waters, Inside Cybersecurity reports, citing the 2026 unified regulatory agenda. Operators could face requirements resembling the January 2025 U.S.-flagged vessel rule: incident reporting to the FBI and CISA, cybersecurity officers, cyber plans and security posture measures. The open question is whether foreign vessels get the same rulebook or a harder one, backed by port denial and detention authorities.
JUL 9
trade-press
CIRCIA, FAR cyber rules crowd September compliance calendar
The September pileup turns incident response into a contracting problem with clocks running at 24 and 72 hours.
Federal News Network reports that the 2026 Unified Agenda puts the Cybersecurity and Infrastructure Security Agency’s final Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule in September: 72-hour incident reports and 24-hour ransomware-payment reports across 16 critical infrastructure sectors. The same agenda targets September for two Federal Acquisition Regulation (FAR) cyber rules, while third-party Cybersecurity Maturity Model Certification (CMMC) assessments are expected to become standard in applicable DoD contracts in November. For primes, contractors and managed service providers, the open issue is whether CISA narrows the 2024 draft’s 300,000-entity scope and clarifies its ambiguous incident trigger.
JUL 7
trade-press
CISA targets September for final CIRCIA reporting rule
The voluntary era ends only if CISA defines the trigger clearly enough for incident responders to use under fire.
NextGov reports that the Cybersecurity and Infrastructure Security Agency (CISA) expects to finalize the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule in September 2026. Covered critical-infrastructure entities would face 72-hour reporting for substantial cyber incidents and 24-hour reporting for ransomware payments; primes, contractors and Certified Third-Party Assessment Organizations (C3PAOs) around those environments need reporting workflows. The voluntary-only model is ending, four years after Congress acted and after CISA missed its October 2025 final-rule deadline; definitions, penalties and safe harbors now do the real work.
JUL 6
trade-press
CRS pushes Congress toward CIRCIA reporting harmonization
The report turns a private compliance complaint into a congressional question: how much DHS agency autonomy is too much.
The Congressional Research Service identified three overlapping Department of Homeland Security cyber reporting regimes, CISA’s Cyber Incident Reporting for Critical Infrastructure Act rulemaking, Coast Guard rules and TSA’s surface transportation proposal, with different incident definitions, destinations and deadlines. Critical infrastructure primes, contractors, state CISOs and counsel could face parallel reporting tracks unless Congress harmonizes the frameworks or agencies reconcile them through CIRCIA and TSA rulemakings.
JUN 30
trade-press
Insurance agents and P&C carriers press CISA for CIRCIA exemption
The fight is over whether critical infrastructure means core financial plumbing or every useful business parked inside the sector.
Inside Cybersecurity reports that at CISA’s June 18 Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) town hall, insurance agents, brokers and property-and-casualty insurers urged an explicit exclusion from covered-entity reporting rules. They argue brokers sell policies rather than underwrite, issue or pay claims, and that P&C carriers can continue core functions during cyber incidents. Contractors, MSPs and primes should watch the boundary call: CISA can define critical infrastructure by actual systemic effect or by sector membership.
JUN 23
trade-press
Business groups press CISA to narrow CIRCIA scope
Industry is asking CISA to prove criticality before forcing small businesses onto another disclosure timer.
Inside Cybersecurity reports that the U.S. Chamber of Commerce and Business Roundtable used CISA’s June 15 CIRCIA town hall to demand narrower covered-entity and “substantial cyber incident” definitions before the final rule. The proposed regime covers an estimated 316,000 entities, roughly 98 percent of them small businesses, with 72-hour incident reports and 24-hour ransom-payment notices. For primes, subs and diversified contractors, the fight is whether CISA can use size as a proxy for criticality without inviting an overreach lawsuit.
JUN 17
trade-press
CISA restarts CIRCIA town halls on 72-hour reporting rule
The deadline is the easy part; the harder fight is which incidents and which entities CISA can realistically absorb.
CISA is resuming virtual town halls on the Cyber Incident Reporting for Critical Infrastructure Act rule after a shutdown pause, Federal News Network reports. The draft would require covered entities across 16 critical infrastructure sectors to report cyber incidents within 72 hours and ransomware payments within 24 hours. Primes, contractors, subs and C3PAOs should watch the scope fight: the draft may reach about 300,000 entities, while definitions and overlap with sector-specific reporting rules remain unsettled.
JUN 12
regulator
CISA revises CIRCIA town hall schedule for critical infrastructure stakeholders
The schedule change appears logistical, not a signal of shifted implementation deadlines, but attendance or review of materials remains the practical next step.
CISA published a revised town hall schedule for stakeholder engagement on the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) reporting requirements. Critical infrastructure operators, their contractors, and state CISOs should confirm the new dates and attend or review materials to track scope and timeline details before enforcement begins. No changes to underlying CIRCIA implementation deadlines have been announced.
MAY 28
regulator
CISA reopens CIRCIA input window with new town hall schedule
A second stakeholder engagement round on a 2024 NPRM is the clearest signal yet that CISA's original reporting scope drew more opposition than the agency can absorb quietly.
CISA announced additional town hall meetings to collect stakeholder input on the CIRCIA Notice of Proposed Rulemaking first published April 4, 2024, which would mandate covered cyber incident and ransom payment reporting for critical infrastructure operators. The reopened window is a rare second bite: covered entities, primes, and their counsel can still argue for narrower scope or reduced reporting burden before CISA finalizes timelines and content requirements. Comment-period close date and any specific NPRM revisions under consideration were not disclosed in the notice.
MAY 26