CIRCIA Incident Reporting Guide: Covered Entities, Deadlines and Rule Status

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) will require many US critical infrastructure organisations to report significant cyber incidents to CISA within 72 hours and ransom payments within 24 hours, but the obligations only start once CISA's final rule takes effect. The statute, codified at 6 U.S.C. 681 to 681g, was signed in March 2022, and CISA published its proposed rule in April 2024. The final rule has slipped past its October 2025 statutory deadline, and the exact scope will only be fixed when it is published. This guide sets out what the statute already fixes, what the proposed rule would add, the rule's status as of 24 October 2026, and how to prepare without over-building. It is written for CISOs, incident response leads and legal and compliance teams in critical infrastructure organisations and the service providers that report for them.

Key takeaways

• No final rule yet. As of 24 October 2026, the Federal Register lists CIRCIA only as a proposed rule; CISA describes the effective date as yet to be determined, and reporting remains voluntary until then.
• The clocks are fixed in statute. 72 hours after a covered entity reasonably believes a covered cyber incident occurred, and 24 hours after a ransom payment, even when the ransomware attack itself is not a covered incident.
• Scope is the open question. The proposed rule covers entities in the 16 critical infrastructure sectors that exceed the SBA small business size standard or meet a sector-based criterion; CISA has said it is examining options to reduce scope and burden.
• Preservation and supplements matter as much as the first report. The proposal requires supplemental reports promptly when new information emerges and data preservation for two years after the last report.
• Enforcement is by request and subpoena. CISA can issue a request for information, then a subpoena, and refer non-compliance to the Attorney General; reports themselves carry strong legal protections.

Scope: who and what is covered

The statute leaves the definitions of covered entity and covered cyber incident to the final rule. The April 2024 notice of proposed rulemaking (NPRM, 89 FR 23644, proposed 6 CFR part 226) shows CISA's starting position.

Covered entities (as proposed)

• Sector test: the entity must be in one of the 16 critical infrastructure sectors.
• Then either: it exceeds the US Small Business Administration size standard for its industry, or it meets one or more sector-based criteria (for example for chemical facilities, communications, energy, healthcare, information technology, transportation, water and nuclear). Meeting a sector-based criterion counts even if the entity does not think of itself as part of that sector.
• Sectors without their own criteria: Commercial Facilities, Dams, and Food and Agriculture rely on the size standard or another sector's criteria.
• Scale: CISA's regulatory impact analysis estimated about 316,244 potentially affected entities and about 210,525 reports over the analysis period, at a total cost of roughly 2.6 billion dollars undiscounted.

Covered cyber incidents (as proposed)

A covered cyber incident is a substantial cyber incident experienced by a covered entity. The NPRM defines a substantial cyber incident as one that leads to any of these four impacts:

The statute and NPRM exclude incidents caused by lawfully authorised government activity, events carried out in good faith at the system owner's request (such as authorised penetration testing), and threats of disruption used purely as extortion. The examples in the table are this guide's interpretation, not CISA text.

Key obligations

• Report content (as proposed): entity and contact details, a description of the incident and its impact, vulnerabilities exploited, tactics, techniques and procedures, indicators of compromise, any information identifying the perpetrator, and mitigation and response activities. Ransom payment reports add the demand, the amount and form of payment, and the outcome. Submission would be through a web-based CIRCIA Incident Reporting Form.
• Third-party reporting: an incident response firm, insurer, law firm or other third party may submit on the entity's behalf, but the covered entity stays responsible. A third party that pays a ransom for a covered entity must advise it of its CIRCIA obligations.
• Substantially similar reporting exception: an entity that must report substantially similar information within a substantially similar timeframe to another federal agency may be excused, once CISA and that agency have a CIRCIA Agreement. CISA said it would not decide which programmes qualify until the final rule. Preservation still applies.
• Other exceptions: certain DNS functions (ICANN, ARIN and root server operators) and federal agencies already reporting to CISA under FISMA.
• Protections: under 6 U.S.C. 681e, reports may be designated commercial and proprietary, are exempt from FOIA, do not waive privilege, cannot be used by governments to regulate the reporting entity (unless the government allows the report to satisfy a regulatory duty), and cannot found a lawsuit or be used as evidence. Victim information must be anonymised when shared.

Timeline and current status

A secondary report dated 8 October 2026 says CISA sent the final rule to the Office of Management and Budget for review on 1 October 2026, citing HIPAA Journal; this guide has not confirmed that on a primary source. The final rule will set the effective date. Until then, CISA asks organisations to report voluntarily to [email protected] or (888) 282-0870. This page will be updated when the final rule is published.

Expect the final rule to differ from the NPRM. The Unified Agenda abstract records that commenters asked CISA to reduce scope and burden, align with other federal reporting rules and clarify key terms, and that CISA is examining options. Plan for the statutory floor (72 hours, 24 hours, supplements, preservation, third-party reporting) and keep the scope assessment flexible.

Enforcement and penalties

1. Request for information: if the CISA Director has reason to believe a covered entity failed to report, CISA may request information. Responses get the same protections as a report.
2. Subpoena: if the entity does not respond within 72 hours of the request, or responds inadequately, the Director may issue a subpoena. The authority cannot be delegated, and an electronic subpoena must carry a cryptographic digital signature; do not act on an unauthenticated one.
3. Civil action: failure to comply may be referred to the Attorney General for a civil action in federal district court, and the court may punish non-compliance as contempt.
4. Other consequences (as proposed): referral to the DHS Suspension and Debarment Official and, for federal contractors, to the contracting official. False statements fall under 18 U.S.C. 1001.

Information obtained by subpoena may be shared with the Attorney General or a federal regulator where it may support enforcement or prosecution. CIRCIA enforcement does not apply to state, local, tribal and territorial government entities. There is no fixed civil fine in the statute; the main risk of non-compliance is the subpoena route and loss of the protections a timely report brings.

What it means for AI agents and non-human identities

Many incidents that would meet the substantial incident test start with a machine credential: a stolen cloud access key, a leaked API token, a compromised managed service provider account or an over-privileged automation account (ATT&CK T1078.004, Valid Accounts: Cloud Accounts). CIRCIA does not regulate identities, but it changes what you must be able to say within 72 hours.

• Third-party compromise is a named impact: unauthorised access through a cloud, managed service or supply chain provider is one of the four proposed impacts. Know which provider identities and integration tokens can reach your environment so you can tell quickly whether a provider breach reached you. See the Third-Party Access Guide.
• Report content needs identity facts: the proposed fields on vulnerabilities, TTPs and indicators include which accounts and credentials were used. Log non-human identity activity in your SIEM with owner and purpose so responders can answer. See the Service Account Security Guide.
• Preservation covers credential evidence: keep logs of token issuance, key use and rotation for compromised identities for the preservation period, and record rotations rather than silently replacing keys.
• AI agents: an agent acting with production credentials can cause an availability or integrity impact as surely as an attacker. Treat agent actions in scope for incident triage, log them, and make sure the agent's credentials can be revoked fast. See the AI Agent Observability and Incident Response Guide.

Compliance steps

1. Assess applicability against the NPRM: confirm your sector, check the SBA size standard for your NAICS code, and test each sector-based criterion. Record the reasoning so it can be redone quickly against the final rule.
2. Inventory overlapping regimes: list every federal, state and sector duty you already have (for example SEC Form 8-K Item 1.05, TSA directives, Coast Guard, NERC CIP, HIPAA, state breach laws, DFARS). These shape whether the substantially similar exception may help. See the SEC Cybersecurity Disclosure Rules Guide and the Data Breach Notification Checklist.
3. Define reasonable belief in your plan: decide who declares that a covered incident has reasonably been believed to occur, and when the 72-hour clock starts. Do not wait for full forensic confirmation.
4. Add a ransom payment path: any decision to pay must trigger the 24-hour report, sanctions screening and legal review in parallel. See the Ransomware Response and Recovery Guide.
5. Prepare a report template: map the NPRM content fields to sources (SIEM, EDR, identity provider, ticketing) and pre-fill entity and contact details.
6. Agree third-party roles: if your incident response retainer, insurer or MSSP will submit, put that in the contract, with a duty to tell you about any ransom payment made for you.
7. Set preservation holds: extend log and image retention for incidents to meet a two-year post-report window, and test that retention actually holds.
8. Exercise and measure: run a tabletop that reaches the 72-hour and 24-hour decisions. See the Tabletop Exercise Guide.

Decision guidance and measurement

• Large, multi-regulated entities: build one incident reporting workflow that produces each regulator's report from the same facts, and watch which CIRCIA Agreements CISA signs.
• Smaller entities near the size threshold: document the assessment and start voluntary reporting practices; avoid buying tooling until the final rule fixes scope.
• Metrics: time from detection to reasonable belief decision; time from decision to report draft in exercises (target under 72 hours with margin); percentage of critical systems whose logs meet the preservation period; percentage of non-human identities with an owner and log coverage; number of third-party providers with defined notification duties.

Common failure patterns

• Waiting for certainty: the clock runs from reasonable belief, not from a finished investigation.
• Forgetting the ransom report: payment decisions made by executives or insurers without telling the reporting team. In the Colonial Pipeline ransomware attack, before CIRCIA existed, a legacy VPN account without MFA led to a shutdown and a ransom payment the day after the attack; that is the kind of case the 24-hour rule is meant to capture.
• Overwriting evidence: rebuilding systems and rotating keys without preserving images and logs first.
• Assuming another report is enough: the substantially similar exception needs a CIRCIA Agreement; until one exists, assume you report to CISA too.

Practitioner checklist

• Check the Federal Register and CISA's CIRCIA page for the final rule and its effective date.
• Document your covered entity assessment against the NPRM criteria and revisit it when the rule is final.
• Write the reasonable belief decision and its owner into the incident response plan.
• Link any ransom payment decision to a 24-hour CISA report and legal review.
• Build a report template mapped to the proposed content fields.
• Set incident data preservation to cover two years after the last report.
• Define third-party submission and ransom payment notice duties in contracts.
• Inventory provider and non-human identities that can reach critical systems, with owners and logs.
• Map overlapping reporting duties and track CIRCIA Agreements.
• Exercise the 72-hour and 24-hour decisions at least annually.

Standards and references

• US Code: 6 U.S.C. 681b, Required reporting of certain cyber incidents
• US Code: 6 U.S.C. 681d, Noncompliance with required reporting
• US Code: 6 U.S.C. 681e, Information shared with or provided to the Federal Government
• Federal Register: CIRCIA Reporting Requirements, proposed rule
• CISA: Cyber Incident Reporting for Critical Infrastructure Act of 2022
• CISA: CIRCIA NPRM Overview
• OMB OIRA: Unified Agenda entry RIN 1670-AA04
• CyberScoop: CISA pushes final cyber incident reporting rule to May 2026

This guide summarises the CIRCIA statute and proposed rule as of 24 October 2026 and is not legal advice. Related NHI Mgmt Group resources: Global Cybersecurity Regulatory Map · SEC Cybersecurity Disclosure Rules Guide · Ransomware Response and Recovery Guide · Incident Response Guide · Data Breach Notification Checklist