CIRCIA, the Cyber Incident Reporting for Critical Infrastructure Act of 2022, directs CISA to require covered entities to report covered cyber incidents within 72 hours and ransom payments within 24 hours. As of CISA's page at review time, the final rule has not been issued, so the mandatory duty has not started.
What the law asks for
According to CISA, the rules it must issue will require two kinds of report:
- Covered cyber incidents, within 72 hours after the entity reasonably believes the incident occurred.
- Ransom payments, within 24 hours of making the payment.
Which entities are covered, and what counts as a covered incident, is set by the final rule, so we do not summarize those definitions here. Read the rule text when it is published.
Where the rulemaking stands
CISA published a Notice of Proposed Rulemaking on 4 April 2024, and the comment period closed on 3 July 2024. CISA held four town hall meetings from 15 to 18 June 2026, and its page says it continues to work on the final rule. The page also says multiple funding lapses affected its rulemaking activity.
Reporting under CIRCIA is not required until the final rule takes effect. CISA still encourages voluntary reporting, by email at report@cisa.gov or by phone at 1-844-Say-CISA.
Do not wait for the final rule
Other deadlines may already apply to you. Contracts, state laws, sector regulators and international rules each have their own clocks. For example, the GDPR clock is covered in our post on the 72 hour breach notification. A single incident can start several clocks at once.
Prepare in five steps
- Name an owner for reporting decisions and a deputy.
- Define triggers. Write down what would make you say "we reasonably believe an incident occurred."
- Prepare a template with the facts you will likely need: timeline, systems affected, indicators, contacts.
- Settle the ransom question in advance: who decides, who must be told, and who files the report if payment is made.
- Rehearse. Run a tabletop that includes a clock, not just a discussion.
Common mistakes
Teams often start the clock in the wrong place, using the date of full confirmation instead of reasonable belief. Others forget that suppliers or managed providers may hold the logs you need, so your contracts should require quick access. Keep a log of decisions during an incident, because it supports your timeline later.
Quick check
Is CIRCIA reporting mandatory today?
Per CISA's page, not until the final rule takes effect. Check the page for its current status before relying on this.
Can I report to CISA voluntarily now?
Yes. CISA encourages voluntary reporting through the email address and phone number on its page.
Safeguard offers compliance and evidence automation that can help you keep the records an incident timeline depends on. It is not an incident response service.
Sources
Last reviewed: 19 October 2026.
