A sweeping new cyber incident reporting regime is poised to reshape how organizations across US critical infrastructure report attacks to the government, yet key details and timelines for implementation remain uncertain.
Passed by Congress and signed into law in March 2022, the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) established a framework and reporting deadlines relating to cyber incidents.
However, the requirements will not come into force until Cybersecurity and Infrastructure Security Agency (CISA) publishes its final implimentation rules.
Under CIRCIA, covered entities have to report cyber incidents to CISA within 72 hours and ransom payments made in response to a ransomware attack within 24 hours after the ransom has been paid.
Organizations in scope include many within the critical infrastructure sector as well all US defense contractors considered to operate critical infrastructure under the DFARS clause 252.204-7012.
"CIRCIA is the broadest cyber reporting mandate the US federal government has ever proposed."
After the first draft of the new rules was published in 2024, CISA is expected to will finalize regulations to implement CIRCIA soon.
However, there have already been delays. October 2025 saw a statutory deadline missed and a May 2026 target also slipped. In July 2026, the US government set the new target for September 2026, according to the Unified Agenda of Federal Regulatory and Deregulatory Actions.
While the US government is yet to provide an update on meeting this new deadline, several cyber governance experts told Infosecurity that organizations potentially in scope should prepare now.
Notably, they based their recommendations on the CIRCIA draft published in the Federal Register by CISA on April 4, 2024.
What We Know About CIRCIA
CIRCA Scope: 16 Sectors, 316,000 entities
The first notable characteristic of CIRCIA is its wide coverage, encompassing businesses, government entities and other organizations.
Entities are subject to the legislation’s requirements if they meet either of the following criteria:
- Being an organization in one of the 16 critical infrastructure sectors that exceeds the US Small Business Administration’s (SBA) small business size threshold
- Being an organization falling within specific sector-based categories, such as hospitals, communications providers, and certain defense contractors and subcontractors, regardless of size
Frank Balonis, field CISO at Kiteworks, assessed that approximately 316,000 entities would have to comply with CIRCIA.
Speaking to Infosecurity, he described the legislation as “the broadest cyber reporting mandate the US federal government has ever proposed.”
"CIRCIA will turn CISA into a meaningful enforcement authority."
Notably, covered entities include 72,000 defense contractors and subcontractors which already report to the US Department of Defense (DoD) under DFARS 252.204-7012 – a DoD contract clause requiring defense contractors and subcontractors to provide adequate security for Controlled Unclassified Information (CUI) and report cyber incidents.
These defense firms make up the single largest sector-based category covered by CIRCIA.
CIRCIA Changes: CISA Gets New Enforcement Authority
The new cyber reporting requirements introduced by CIRCIA have been described as “important and impactful” by Zack Finstad, VP of cybersecurity at Logically, because it is the first evidence of a cross-sector cyber mandate.
“Today, there are other laws of this kind, but they are either associated to publicly traded companies or sector-specific,” he said.
Emil Sayegh, CEO of CyberSheath said that CIRCIA introduces a “shift” for CISA, the country’s cybersecurity agency.
“CIRCIA will turn CISA into a meaningful enforcement authority. It will have administrative subpoena power, and ultimately, the government can pursue enforcement through the courts,” he said.
This new status for CISA is emphasized by another CIRCIA provision: record preservation requirements.
Under the proposed rule, covered entities would be required to retain records and information related to reported incidents for two years, including technical evidence, logs, communications, and any other information associated with the incidents.
While these changes introduced new requirements for covered entities, CIRCIA will also shield submitted reports from Freedom of Information Act (FOIA) disclosure and from being used as evidence in enforcement actions – unless they waive these privileges.
However, Kitework’s Balonis noted that this protection “doesn't cover the underlying incident or a response compelled by subpoena, and noncompliant entities can face subpoenas and referral to the Department of Justice (DoJ) or, for federal contractors, to suspension and debarment officials.”
CIRCIA will establish a Cyber Incident Reporting Council, chaired by the Department of Homeland Security (DHS), to harmonize overlapping federal cyber incident reporting requirements.
This mechanism is particularly relevant to the DIB, where organizations may already be subject to reporting requirements under DFARS 252.204-7012. For these organizations, overlapping requirements could create additional compliance and reporting burdens.
DIB organizations also need to comply with NIST SP 800-171, which sets out the security requirements for protecting CUI, and Cybersecurity Maturity Model Certification (CMMC), which provides a framework for verifying that those security requirements have been implemented.
“There’s a lot of uncertainty during an incident, especially when you’re still trying to combat or oust an intruder or recover from an attack,” Sayegh said. “The last thing you need in those moments is to send several forms to different entities.”
Read more: Pentagon Suspends CMMC Phase II Requirements for Defense Contractors
Key CIRCIA Details Still Awaiting Clarification
Uncertainty Over CIRCIA Coverage
Despite these known changes, CyberSheath’s Sayegh cautioned that a lot remains to be confirmed about the finalized version of CIRCIA. “The rule is not final at this point, so we don’t know where this is going to land,” he warned.
For instance, he highlighted that it is not yet entirely clear whether all organizations handling CUI would be covered by the legislation.
Unclear CIRCIA Publication Timeline
Additionally, the publication date remains unknown. It is possible that this new delay is linked to the recent suspension of CMMC Phase II.
However, Sayegh is not convinced as CMMC is a DoD program while CIRCIA was enacted by Congress.
Additionally, he argued that the suspension of Phase II was to alleviate the cost linked to mandatory third-party assessments expected to be introduced for covered entities, especially small businesses, while CIRCIA “has no direct cost for covered entities and already exclude some small businesses.”
For Sayegh, the consecutive delays in the publication of CIRCIA is likely due to CISA funding challenges induced by the US government shutdown at the end of 2025 and beginning of 2026.
"CIRCIA is not as much of a heavy lift for covered entities as CMMC Phase II was expected to be."
While he thinks the new September deadline could “slip again,” he nevertheless believes this potential further delay will be “counted in weeks, not months.”
Less optimistic, Logically’s Finstad expect no major development before the Midterm elections to be held in early November 2026.
Unclear CIRCIA Enforcement Timeline
Another CIRCIA mystery is whether the legislation will be enforced straight after its publication.
“A published rule doesn't create an enforceable deadline by itself,” Balonis noted, “CISA's own process points to a compliance window of months after publication, so reporting duties likely start sometime after September, possibly sometime in late 2026 or 2027.”
Finstad also thinks CISA will grant covered entities a grace period to “allow for policy creation internally.”
On the other hand, Sayegh said enforcement could come quick as CIRCIA is “not as much of a heavy lift for covered entities as CMMC Phase II was expected to be.”
“There’s no audit requirement per se, it’s more of a government information-sharing mandate,” he added.
Potential Consequences for Noncompliance
Finally, there is still uncertainty around what enforcement action will apply to entities found noncompliant once the legislation is imposed.
While sanctions and penalties for non-compliance are still unclear, Sayegh suggested CISA could refer breaching entities to the DoJ in “the same way the DoJ has been going after companies that have been accused of cyber fraud.”
“That could be an avenue the government resorts to in order to make an example of a few companies and put the fear on the rest to comply,” he argued.
Preparing for CIRCIA
Potential Indirect Costs For Covered Entities
For Balonis, whatever the exact publication date and enforcement dates turn out to be, the direction is not in question.
“Washington wants real time visibility into breaches across critical infrastructure, and organizations that build toward that now will not be scrambling when the final rule lands,” he said.
"Entities covered by CIRCIA should not wait and see which date holds."
Additionally, Finstad highlighted that while CIRCIA may not induce a direct cost for covered entities, it will likely require more cyber investment, especially for the small organizations in scope.
He cited one clear bottleneck: the retention policy and technology of some organizations is not fit for purpose in a CIRCIA era.
“Say you find out about an incident only 60 days after it has occurred. Well, some systems only capture 30 days of information, that’s all they retain. This, for instance, will have to change,” he said.
What Critical Infrastructure Organizations Need to Do Now
Despite the successive publication delays, Balonis told Infosecurity that the right response for entities potentially covered by CIRCIA is to build the reporting and evidence infrastructure the rule will eventually require.
He cautioned “not to wait and see which date holds.”
Based on the recommendations from Logically and CyberSheath, Infosecurity has outlined the following CIRCIA compliance playbook:
- Determine whether your organization is likely to be a covered entity by assessing your size against SBA thresholds, reviewing relevant contracts, clearances and programs – particularly for defense contractors – and assessing whether you handle information or perform services that could bring you within CIRCIA’s scope regardless of size
- Conduct a gap assessment of your current cybersecurity, compliance and regulatory posture to identify where existing policies, processes and capabilities may need to be strengthened ahead of CIRCIA’s final requirements
- Update and map your incident response plan to CIRCIA’s requirements, including defining who determines whether an incident is reportable, who is responsible for submitting reports, what information must be collected and how the organization will meet the applicable reporting timelines
- Map all applicable incident reporting obligations in a single framework, including CIRCIA’s 72-hour incident and 24-hour ransom-payment reporting requirements, as well as requirements under DoD/CMMC, other federal or state regulators, insurers, customers and sector-specific regimes, to identify and manage overlapping obligations
- Establish a single, harmonized reporting process for incidents subject to multiple reporting regimes, including clear procedures for determining when and where reports must be submitted to organizations such as CISA, the DoD, the Securities and Exchange Commission (SEC) or state authorities, where applicable
- Strengthen detection, investigation and evidence-preservation capabilities by ensuring appropriate monitoring and SOC coverage, endpoint visibility, centralized logging and sufficient retention of logs and other forensic evidence. Organizations without adequate internal capabilities should consider using a managed security service provider (MSSP) or managed detection and response (MDR) provider
- Establish data-retention strategies that support CIRCIA investigations and reporting, including coordinating with third-party service providers to ensure that sufficient logs, records and historical data are retained for the required period
- Establish clear internal reporting timelines and responsibilities, including procedures for meeting the 72-hour incident-reporting and 24-hour ransom-payment deadlines and for submitting supplemental information as investigations develop
- Conduct regular tabletop exercises to test incident-response and CIRCIA reporting procedures, including scenarios outside normal working hours, to test escalation paths, decision-making, reporting timelines and information requirements
- Establish supply-chain notification and reporting protocols, particularly for organizations acting as prime contractors, so that critical subcontractors know how and when to notify the organization of an incident and how applicable reporting requirements are flowed through the supply chain
- Prepare for implementation during any transition or grace period by developing, testing and socializing reporting playbooks in advance, so that teams are ready to comply once the final requirements take effect
- Establish a continuous-improvement process for CIRCIA compliance, reviewing and updating policies, procedures and playbooks on a regular cadence, such as every 6–12 months, and incorporating lessons learned from exercises and real incidents
For defense contractors and subcontractors, experts also recommended to align CIRCIA processes with existing DoD, DFARS, NIST SP 800-171 and CMMC requirements to reduce duplication, maintain consistent incident-reporting procedures and avoid creating separate compliance processes where existing capabilities can be leveraged.
Way Forward: Build Evidence-Based Incident Response
Despite the delays surrounding CIRCIA and the suspension of CMMC Phase II, Balonis and Finstad emphasized that the current US administration appears increasingly focused on requiring critical organizations to demonstrate stronger cyber governance.
For organizations preparing for CIRCIA, this means that waiting for regulatory certainty may not be the most practical approach.
Balonis explained, “The readiness gap we keep finding, whether it's CIRCIA's 72-hour clock, CMMC's self-attestation or general incident response is really the same gap showing up in different regulatory clothing.”
Ultimately, Balonis argued that organizations need to move beyond simply having policies and plans on paper and focus on being able to demonstrate that those measures work in practice.
“Most organizations can produce a plan and a confident answer when asked, but far fewer can produce the evidence, the current documentation, the audit trail, the rehearsed decision path, that would hold up when a regulator, an assessor, or a reporter is actually checking.”
He added that this preparation remains worthwhile regardless of when CIRCIA takes effect, because “the risk it addresses does not wait for Washington's calendar.”