CIRCIA Incident Reporting Requirements (2026): Who Must Report & What to Do Now

1. The Final CIRCIA Rule Is in the Last Mile

On October 1, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) sent its final rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) to the White House Office of Management and Budget (OMB) for review. It has not been published yet. Once it clears that review — press reports expect publication before the end of 2026 — covered entities will face two hard federal reporting deadlines that most organizations do not have today.

This guide explains what CIRCIA is, who is likely to be a “covered entity,” the two reporting clocks (72 hours for a covered cyber incident and 24 hours for a ransom payment), where the rulemaking stands, and how small and medium businesses should prepare. It reflects the public record as of October 2026, and anything only the final text can settle — exact thresholds, the effective date, the reporting format — is flagged as pending rather than asserted.

2. What Is CIRCIA and Why Does It Exist?

CIRCIA is the Cyber Incident Reporting for Critical Infrastructure Act of 2022, signed into law in March 2022. Its statutory framework sits in 6 U.S.C. § 681 (with the reporting-duty provisions at 6 U.S.C. 681b). The law directs CISA to write regulations requiring certain organizations — “covered entities” — to report covered cyber incidents and ransom payments to CISA.

The problem CIRCIA fixes is that federal incident reporting is fragmented: state, sector, and agency rules (HIPAA for healthcare, SEC and banking rules for finance, state breach-notification laws) each have their own triggers and timetables. Standardized, fast, federal data lets CISA quickly learn when a critical entity is hit, analyze reports across sectors to spot a campaign, and warn other potential victims. As CISA notes, CIRCIA reports allow it to “rapidly deploy resources and render assistance” and “warn other potential victims.”

Reporting is not yet required: it starts only once the final rule takes effect. Until then, CISA encourages voluntary reporting through its Report a Cyber Issue channel.

3. Who Must Report? “Covered Entities” in the 16 Sectors

CIRCIA frames coverage around the 16 critical infrastructure sectors identified in Presidential Policy Directive 21: chemical; commercial facilities; communications; critical manufacturing; dams; the defense industrial base; emergency services; energy; financial services; food and agriculture; government facilities; healthcare and public health; information technology; nuclear reactors, materials, and waste; transportation systems; and water and wastewater systems.

The final rule is what turns sector membership into an enforceable individual obligation. In its April 2024 Notice of Proposed Rulemaking (NPRM), CISA proposed that an entity in a critical-infrastructure sector would be covered if it exceeded the Small Business Administration (SBA) size standard for its industry, or met certain sector-based criteria — for healthcare, for example, owning or operating a large or critical access hospital, or manufacturing select essential drugs or Classes II and III medical devices.

That proposal drew substantial pushback on breadth, and the exact thresholds were still being finalized when the rule went to OMB on October 1, 2026. Whether the final text adopts the SBA-size test, and where it draws the revenue, headcount, and carve-out lines, will only be known once it publishes. Do not pencil in a cutoff before that text is public.

The honest SMB takeaway: the proposal’s structure suggests many genuinely small businesses would fall below the size line and most likely land outside the covered-entity definition, while larger companies in a critical-infrastructure sector — and smaller ones that meet an explicit sector criterion, such as owning an eligible hospital — could be in scope. “Likely” is not “decided.” Once the final rule publishes, check your sector plus size and activity against the final criteria.

4. The Two Clocks: 72-Hour Incident Report and 24-Hour Ransom Payment

CIRCIA imposes two distinct deadlines, both written into the statute (6 U.S.C. 681b):

• 72 hours for a covered cyber incident. A covered entity must report to CISA no later than 72 hours after it reasonably believes the incident occurred. The statute also bars CISA from requiring the report any earlier than 72 hours.
• 24 hours for a ransom payment. A covered entity that makes a ransom payment must report it within 24 hours after the payment is made — even when the underlying ransomware attack would not itself qualify as a covered cyber incident.

These are separate triggers and separate clocks that can run in tandem. An organization hit by ransomware that disrupts systems and then pays to restore them could face both filings at once. Compared with familiar 60-day HIPAA-style and state notifications, 24 to 72 hours is genuinely compressed — which is exactly why preparation matters.

The statute also contemplates supplemental reports on substantial new information and a duty to preserve related data. The final rule settles manner and form — CISA’s NPRM proposed a single, dynamic, web-based form.

5. What Counts as a Reportable “Covered” or “Substantial” Incident?

CIRCIA does not require reporting every security event — only covered cyber incidents with a substantial impact on the entity or its operations. The 2024 NPRM proposed covering incidents that cause substantial loss of confidentiality, integrity, or availability of an information system or network, including through ransomware, denial-of-service, or similar disruption.

Treat the precise “substantial cyber incident” definition as pending, but rely on two safe principles today. First, a ransom payment always triggers the 24-hour clock regardless of whether the attack satisfied the covered-incident threshold. Second, for the 72-hour clock, an incident that materially degrades availability (systems down), confidentiality (data exposed), or integrity (data or systems manipulated) is the kind of event a covered entity should assume may be reportable and prepare to escalate. Routine phishing, contained single-user credential alerts, and minor scans typically are not — but the final rule is the definitive authority.

6. Timeline: What Has Happened and What Happens Next

• March 2022 — CIRCIA signed into law (statutory framework at 6 U.S.C. § 681).
• April 4, 2024 — CISA publishes the NPRM in the Federal Register (document 2024-06526, docket CISA-2022-0010); the comment period is extended into mid-2024 over the rule’s length and complexity.
• 2024–2026 — Funding lapses and turnover slow rulemaking; comments emphasize narrowing scope and harmonizing with existing federal, state, and international regimes.
• June 15–18, 2026 — CISA holds four public town-hall meetings ahead of the final rule.
• October 2025 → May 2026 → September 2026 — The final-rule target is pushed back repeatedly; a statutory target of October 2025 is missed, then May and September 2026.
• October 1, 2026 — CISA submits the final rule to the White House OMB/OIRA for review. As of this writing it has not been published.

Next is not a firm schedule. OMB review typically runs 30–90 days, and press reports expect publication before the end of 2026 — an expectation, not a commitment. Reporting obligations then take effect on dates the rule itself sets, after a window of months for education and phase-in; analysts expect duties to begin in late 2026 or 2027, but the exact effective date is not fixed and will not be known until the rule publishes.

7. How Small and Medium Businesses Should Prepare

Preparation splits into two buckets: what you must do if the final rule puts you in scope, and what is good incident-response hygiene regardless. CIRCIA is not a mandate for every business — but strong incident response helps every business.

If you may be a covered entity

• Know your sector and size. Once the final rule publishes, compare your sector, revenue, headcount, and activities against the final criteria. Until then, treat the 2024 proposal as a planning input only.
• Decide who calls the incident. Write down who across IT, legal, and compliance determines that a “reasonable belief” of a covered incident exists, and how that decision is logged and timestamped. The 72-hour clock starts at reasonable belief, not certainty.
• Map your deadlines. Put the 72-hour CISA report, the 24-hour ransom report, and your existing HIPAA/state/insurance deadlines side by side in one incident response plan with a named owner for each.
• Build a ransomware runbook. Decide who can approve a payment (the 24-hour clock) and what the forensics, legal, and insurer roles are — before a demand arrives.

Good hygiene regardless of scope

Even if you end up outside coverage, the controls that cut incident likelihood and impact — tested incident response, an inventory of high-value systems, strong access controls, and a clear escalation path — are the same ones that make a fast report possible. You cannot meet a 72-hour clock without knowing, quickly, whether you have a real incident.

8. FAQ: CIRCIA Incident Reporting at a Glance

Do I have to report yet?

No. Reporting is not required until the final rule takes effect, and it is still under White House review as of October 2026. Until then CISA encourages voluntary reporting.

What are the deadlines?

The statute sets two: report a covered cyber incident within 72 hours of reasonably believing it occurred, and report a ransom payment within 24 hours of paying. The rule sets the effective date and format.

What happens if I don’t report?

CIRCIA lets CISA request information on failures to report and refer matters to the appropriate federal agency, with civil penalties established by regulation. Treat a missed report as a serious regulatory exposure.

Does this overlap with HIPAA, SEC, or state rules?

Yes, and harmonization is a central open issue. The statute allows an exemption for entities that already report substantially similar information to another federal agency within a substantially similar timeframe — but only once CISA and that agency have an agreement in place.

Does CIRCIA cover small businesses?

Possibly, depending on sector and size. The structure of the 2024 proposal suggests many small businesses would fall below the size threshold, but the criteria are not final. If you are in a critical-infrastructure sector, plan as if you might be in scope and confirm once the rule publishes.

Use Our Free Calculators to Get Ready

The controls that make 72-hour reporting achievable and limit breach impact are measurable. Our free tools size the problem and assess readiness before a clock starts running.

• Ransomware Cost Calculator — estimate the total cost of an attack, including a ransom payment, so your 24-hour decision is already informed.
• NIST CSF Assessment — score your incident-response and detection posture against the NIST Cybersecurity Framework, the controls CISA promotes.
• Breach Cost Estimator — quantify a breach’s financial exposure across lost business, detection, response, and notification.
• Compliance Scorecard — see how ready you are for the regulatory obligations, existing and emerging, that apply to your organization.