PERSPECTIVE: What CIRCIA Means For The Nation's Critical Infrastructure

Picture a water utility in the Midwest. It’s a Tuesday afternoon, and an operator notices something odd — a control system that shouldn’t be talking to the outside world is doing exactly that. Nobody knows yet whether this is a misconfigured device, a curious researcher, or the opening move of an attack on the water supply for half a million people. What happens in the next 72 hours will matter not just to that utility, but to the federal government’s ability to see the threat coming for the next one.

That scenario is exactly what Congress had in mind when it passed the Cyber Incident Reporting for Critical Infrastructure Act of 2022, better known as CIRCIA. And after years of delay, the rule that will finally put CIRCIA into force is close. The Cybersecurity and Infrastructure Security Agency (CISA) is now targeting September 2026 to issue the final rule, with covered entities potentially facing real reporting obligations as soon as late 2026 or early 2027. CISA has estimated that