CIRCIA, a 2022 US law, will require covered entities to report covered cyber incidents to CISA within 72 hours and ransom payments within 24 hours. CISA's page says the final rule is not yet published, so mandatory reporting under it has not begun. Check the page for updates.
What the law will require
According to CISA, once the final rule takes effect, covered entities must report covered incidents within 72 hours after they reasonably believe the incident occurred, and report a ransom payment within 24 hours of making it. Federal agencies must also share reports with CISA within 24 hours, and CISA must share CIRCIA information with other agencies within the same window.
Timeline from CISA's page
- March 2022: CIRCIA enacted.
- 4 April 2024: proposed rule published.
- 3 June 2024: correction to the proposal published.
- 3 July 2024: comment period closed.
- February and May 2026: notices of town hall meetings.
- 15 to 18 June 2026: four town hall meetings.
CISA says it is still reviewing comments and working on the final rule, that funding lapses delayed activity, and that no date is given for the final rule.
What this means for you today
The page states that organisations are not required to submit reports until the final rule's effective date. CISA encourages voluntary reporting through cisa.gov/report, report@cisa.gov or 1-844-Say-CISA.
Do not wait to prepare
Even without a date, the design is clear enough to plan around:
- Know if you might be covered. The proposal defines covered entities, so read it against your sector and size. This post does not try to do that for you.
- Build the clocks into your plan. A 72 hour incident clock and a 24 hour payment clock mean your plan must say who decides what, quickly.
- Capture facts as you go. Reports need technical details, so keep a timeline from the first hour.
- Link it to payment decisions. If a payment is ever made, someone must own the 24 hour report.
Other rules still apply
CIRCIA is separate from public company disclosure rules, sector regulators and contract notice terms. Those can already apply today.
Questions to ask counsel
- Might we be a covered entity under the proposed rule, and in which sector category?
- What would count as a covered incident for us?
- Who would file, and with what internal approval?
- How does this interact with our contracts and other regulators?
Come to that conversation with your incident timeline template, so counsel can react to something concrete.
Quick check
Is the CIRCIA final rule in force?
According to CISA's page at the time of review, no. The page says it is still working on the final rule and gives no date. Check the page again before relying on this.
Should we report voluntarily?
CISA encourages it. Decide with counsel, and put the contact route in your plan.
Sources
Last reviewed: 19 October 2026.
