The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) will require covered entities to report covered incidents to CISA within 72 hours and ransom payments within 24 hours. According to CISA's page, that reporting is not yet required. It starts only when the final rule takes effect.
What CISA's page says
CISA states that covered incidents must be reported within 72 hours after the entity reasonably believes the incident occurred, and ransom payments within 24 hours of payment. It also says reporting begins only once the final rule is in effect, and gives no date for that.
The page records these steps so far: a proposed rule published in the Federal Register on April 4, 2024, comments closed July 3, 2024, and a correction published June 3, 2024. It lists four town halls held between June 15 and June 18, 2026. It says funding lapses affected the rulemaking and that CISA is still working on the final rule.
Check CISA's CIRCIA page for the current state before you rely on any of this, because it can change.
What this means today
Two things are true at once. You have no CIRCIA filing duty yet. And other duties may already apply to you, such as sector rules, state laws and contracts. See our notes on FTC and NYDFS deadlines.
CISA also encourages voluntary reporting now, through its report page, a dedicated email address and a phone line published on the CIRCIA page.
Preparing without waiting
The proposed shape is easy to plan for, even if details change.
- Decide who can make the "reasonable belief" call and how fast they can be reached.
- Keep a template listing what you would tell a federal agency: what happened, systems affected, indicators, timeline.
- Make sure your finance and legal leads know a ransom payment has its own shorter clock in the proposal, and that they are looped in before any payment.
- Hold a tabletop that includes a handover to a person who files, not only to those who investigate.
Who will likely be covered
CISA's page, as fetched, does not settle which entities are covered, because that depends on the final rule. Until it is published, treat any list of covered sectors you see as a proposal. If you operate in a critical infrastructure sector, ask your counsel or sector body how the proposal might apply to you, and revisit when CISA posts the final text.
Do not over-read the proposal
Details like which sectors and sizes are covered depend on the final rule. Do not tell customers or auditors that you are "CIRCIA compliant". There is nothing to comply with yet. Say instead that you track the rulemaking and maintain incident reporting procedures.
Quick check
Do we have to report to CISA under CIRCIA today?
Not under CIRCIA. CISA's page says reporting begins when the final rule takes effect. Other obligations may still apply to you.
What are the proposed deadlines?
72 hours for a covered cyber incident and 24 hours after a ransom payment, per CISA's description of the law.
Sources
Last reviewed: 19 October 2026.
