The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) will require covered entities to report covered cyber incidents within 72 hours and ransom payments within 24 hours. Mandatory reporting does not start until CISA's final rule takes effect, and CISA's page gives no date for that.
The two deadlines
According to CISA's CIRCIA page:
- Covered cyber incidents are to be reported within 72 hours after the entity reasonably believes an incident occurred.
- Ransom payments tied to a ransomware attack are to be reported within 24 hours of the payment.
Where the rulemaking stands
CISA says it published the proposed rule in the Federal Register on 4 April 2024, and the comment period closed on 3 July 2024. The page says CISA held four town hall meetings between 15 and 18 June 2026 and is still reviewing comments and working on the final rule. It also says multiple funding lapses have affected progress.
Because the page lists no effective date, do not assume one. Check CISA.gov/CIRCIA for updates.
What you can do now
Voluntary reporting is open. CISA encourages reports through CISA.gov/report, report@cisa.gov or 1-844-729-2472.
Preparing now is cheap:
- Work out whether you might be a covered entity. The definitions come from the final rule, so watch for it.
- Set an internal clock for "reasonable belief" in your incident plan.
- Add a step to your ransomware playbook that logs any payment decision and who must be told. See the ransom payment decision.
- Collect the facts a report would need: systems affected, timeline, indicators and contacts.
How it differs from other deadlines
CIRCIA is a report to the government, not to affected individuals. Other duties still apply separately, such as GDPR Article 33 or SEC Form 8-K Item 1.05. One incident can trigger several clocks that start at different moments.
A readiness worksheet
Spend an hour on these questions with legal and your incident lead.
- Which of our services could be called critical infrastructure by a customer or regulator?
- Who decides that we "reasonably believe" a covered incident occurred, and how is that recorded?
- Who has authority to report to CISA, and do they have the contact details offline?
- If we pay a ransom, who owns the 24 hour report, and who tells them?
- Which other regulators and customers would need to hear about the same event, and in what order?
Write the answers into the plan and rehearse them. A deadline measured in hours leaves no time to find the right person, so the preparation is the whole game. Keep the worksheet next to your ransomware playbook and update it when the final rule appears.
Quick check
Is CIRCIA reporting mandatory today?
According to CISA's page, mandatory reporting does not begin until the final rule takes effect. Voluntary reporting is encouraged now.
Who is a covered entity?
The final rule will define it. Do not rely on the proposed text alone.
Sources
Last reviewed: 19 October 2026.
