CIRCIA final rule sets 72-hour reporting across 16 sectors

CISA's final Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule is on the doorstep, and the White House is presenting it as the fix for overlapping incident reporting. National Cyber Director Sean Cairncross told Federal News Network that real work went into making the rule harmonize existing requirements rather than duplicate them. That's the right ambition. It's also the claim most worth checking once the text lands.

The previewed contours are one reporting standard across all 16 critical infrastructure sectors, with a 72-hour deadline for major cyber incidents. For contractors, primes, and state and local CISOs inside those sectors, a single federal clock pulls scattered duties toward one timeline.

Whether it works depends on two details the preview doesn't provide: the effective date, and when the 72-hour clock starts.

Harmonization can collapse duplicate filing duties, or it can add a sixteenth overlapping requirement and call it consolidation. "Major cyber incident" and "72 hours" only do half the work until the rule text is clear about when the countdown begins. And the final text isn't public, so every specific in circulation is the White House's read of a document the compliance audience can't yet see. The test of whether CIRCIA cut compliance friction, or just renumbered it, is which legacy regimes the rule actually retires.

Monday changes nothing. The operational move is an inventory: list every sector-specific reporting duty your organization already answers to and each one's definition of when the clock starts. When CISA publishes the text, the first question is which of those duties disappear.