CIRCIA Rule Advances, Bringing New Cyber Reporting Requirements Closer

The Cybersecurity and Infrastructure Security Agency's (CISA) final rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) moved to the Office of Management and Budget (OMB) for review on October 1 after the agency missed its previously announced September 2026 publication target. OMB review is the final major regulatory review step before the final rule is published.

Broad Effects on Critical Infrastructure

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) established a mandatory cyber incident reporting framework intended to improve the federal government's visibility into threats affecting critical infrastructure and support coordinated response and information sharing. Under the proposed reporting rule, CISA estimated that approximately 316,000 entities across 16 critical-infrastructure sectors would be subject to reporting and related record-preservation requirements. Potentially affected industries include