CISA Announces Town Halls On Cyber Incident Reporting Rulemaking

UPDATE: On March 9, 2026, CISA posted to its website that it will not be holding the scheduled town halls due to the current DHS shutdown and, relatedly, publication of the final CIRCIA rule likely will be delayed. The full statement is available here.

The Cybersecurity and Infrastructure Security Agency ("CISA") will be hosting a series of upcoming virtual town hall meetings related to its rulemaking under the Cyber Incident Reporting for Critical Infrastructure Act ("CIRCIA"). As a reminder, forthcoming regulations under CIRCIA will impose a 72-hour reporting requirement for covered critical infrastructure entities to notify the government of certain qualifying cyber incidents (we wrote about the proposed rule in detail here). Once finalized, these rules will have significant compliance implications for many government contractors and subcontractors, particularly those operating in the defense and information technology sectors.