As of 9 October 2026, the CISA page on the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) says that CISA continues to work on the final rule and that CIRCIA reporting is not required until that rule goes into effect. This post summarizes that one CISA page, including its dates. The page gives no effective date.
What does CIRCIA require CISA to do?
The CISA page says CIRCIA requires the Cybersecurity and Infrastructure Security Agency to develop and implement regulations requiring covered entities to report covered cyber incidents and ransomware payments to CISA. The page gives CISA’s reasons for wanting these reports: to deploy resources and help victims, to analyze reporting across sectors to spot trends, and to share that information with network defenders.
The page also says some of CISA’s authorities under CIRCIA are regulatory in nature. CISA has to complete mandatory rulemaking before the reporting requirements go into effect. The page says the Act was enacted in March 2022.
Where is the CIRCIA rulemaking in 2026?
The page lists the dated steps below. It says CISA is still reviewing comments on the proposal.
- March 2022CIRCIA enactedThe Act requires CISA to develop reporting regulations.
- 4 Apr 2024NPRM publishedFederal Register, 89 FR 23644. Comments open until 3 Jul 2024.
- 3 Jun 2024Correction publishedFederal Register, 89 FR 47471.
- 3 Jul 2024Comment period closesComments are on docket CISA-2022-0010.
- 13 Feb 2026First town hall noticeFederal Register, 91 FR 6794.
- 26 May 2026Second town hall noticeFederal Register, 91 FR 30498.
- 15 to 18 Jun 2026Four town hall meetingsTranscripts and materials are on the rulemaking docket.
The Federal Register notice of the proposal lists comments due on or before 3 June 2024, while the CISA page says the comment period ran until 3 July, so the two pages word the closing date differently. The CISA page says CISA is reviewing and considering the comments received during the NPRM public comment period. It also says CISA held four town hall meetings between 15 June and 18 June 2026, and that transcripts, an attendees list and supplemental materials received within seven days of the meetings are publicly available on the rulemaking docket.
Has CISA published the final rule?
The page does not say so. It says CISA continues to work on the final rule, and it says “multiple funding lapses impacted CISA’s ability to conduct rulemaking activity for CIRCIA”. CISA says it will communicate updates on the rulemaking process and timeline through its CIRCIA web page, and stakeholders can subscribe to receive updates.
The page also describes the schedule the Act set. CIRCIA required CISA to publish an NPRM within 24 months of enactment, and to issue a final rule within 18 months of the NPRM’s publication. The page does not state a new date for the final rule, and this post does not estimate one.
What did the NPRM propose for covered entities?
The page is brief on this. It says the Act requires CISA to issue regulations requiring covered entities to report covered cyber incidents no later than 72 hours from the time the entity reasonably believes the incident occurred. For ransomware, the Act requires regulations requiring covered entities to report within 24 hours of making any ransom payment made as a result of a ransomware attack. The page says CISA’s proposed regulations for both requirements are reflected in the NPRM.
The page links fact sheets on what a covered entity and a covered cyber incident are. It describes them as the basis for who reports under the NPRM: a covered entity that experiences a covered cyber incident is required to report. The definitions sit in those documents, not in the page text, so check them directly. For how these two clocks compare with other regimes, see our post on incident reporting deadlines under NIS2, the CRA, SEC rules and CIRCIA. For the US securities side, see the SEC cyber disclosure rules and Form 8-K Item 1.05.
Should organizations share incident information before the rule?
CISA encourages all entities to voluntarily share information on cyber incidents before the effective date of the final rule. The page gives its reason: when information is shared quickly, CISA can use it to render assistance and to warn other organizations. It lists ways to share: www.cisa.gov/report, report@cisa.gov or 1-844-Say-CISA (1-844-729-2472). It also links a voluntary reporting resource covering who CISA recommends report an incident, why and when, and what and how.
The page makes no claim about what a given organization must do, and this post is not legal advice. One question that follows from the page: does your incident response plan say who would decide to share information with CISA voluntarily, and for a ransomware case, who would record a payment and its time? Treat that as a planning check, not a requirement.
How does this fit a wider 2026 and 2027 calendar?
CIRCIA is one of several reporting regimes with different status. Our overview of cyber regulations security teams should know in 2026 and the cyber compliance calendar for 2026 and 2027 put it next to the EU measures. Unlike dated EU deadlines, the CISA page gives no date for CIRCIA. A calendar question that follows is how to record an item whose date the source does not state. CISA says it will communicate updates through its CIRCIA web page.
Last checked against the official pages on 9 October 2026. Dates and status can change, so confirm on the pages listed under Sources before acting.
For background on how threats are cataloged, see the Brandefense knowledge hub pages on threat groups, malware families, ATT&CK techniques and significant incidents, and the glossary. The cyber threat intelligence page describes the related service.