CIRCIA 72-Hour Reporting Deadline: CISA Incident Reporting Guide

Where CIRCIA stands in 2026

The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) was signed into law in March 2022. It directs the Cybersecurity and Infrastructure Security Agency (CISA) to require covered entities in the 16 critical infrastructure sectors to report two things: substantial cyber incidents and ransom payments.

The statute does not take effect on its own. The reporting duties begin when CISA's final rule becomes effective. CISA published its Notice of Proposed Rulemaking in April 2024, missed the October 2025 statutory target, moved to May 2026 and then to September 2026. That target has also passed without a final rule.

Status as of October 2, 2026

The final CIRCIA rule has not yet appeared in the Federal Register. The 72-hour and 24-hour deadlines are set in the statute; the definitions of covered entity and substantial incident may still change from the proposal. This page will be updated when the final rule is published.

For CIOs and CISOs, the practical message is that the deadlines are known and the scope is largely visible in the proposal. Detection and escalation capability is the part that takes longest to build, so it is the part to start now.

The two CIRCIA clocks

CIRCIA creates two separate reporting duties with different triggers:

Report	Deadline	Clock starts	Applies when
Covered cyber incident report	72 hours	When the entity reasonably believes the incident occurred	The incident meets the substantial threshold
Ransom payment report	24 hours	When the payment is made	Any ransom paid after a ransomware attack, even if the incident is not substantial
Supplemental report	Promptly	When substantial new or different information becomes available	Until the entity notifies CISA the incident is concluded and fully mitigated

The proposed rule allows a single joint report when a covered entity pays a ransom related to a covered incident before its 72-hour report is due. Note the trigger for the 72-hour clock: reasonable belief, not confirmation. An alert that sits in a queue overnight is time taken from the reporting window.

Who is a covered entity

The proposed rule defines a covered entity as an entity in a critical infrastructure sector that either exceeds the Small Business Administration size standard for its industry or meets one of a set of sector-based criteria. Sector criteria pull in many smaller organizations regardless of size, for example:

Owners and operators of critical infrastructure under existing federal cyber rules, such as pipelines, rail, nuclear and bulk electric systems.
Hospitals and certain medical device manufacturers in healthcare.
State, local, tribal and territorial governments above population thresholds.
Providers of IT, communications and cloud services to the federal government.
Entities in chemical, water, transportation, financial services and education subsectors that meet the listed criteria.

CISA estimated in the proposal that around 316,000 entities would be covered. If your organization operates in or supplies one of the 16 sectors, assume you are in scope until counsel confirms otherwise against the final rule.

What counts as a substantial cyber incident

The proposed rule treats an incident as substantial when it leads to any of these:

A substantial loss of confidentiality, integrity or availability of an information system or network.
A serious impact on the safety and resiliency of operational systems and processes.
A disruption of the ability to engage in business or industrial operations, or deliver goods or services.
Unauthorized access facilitated by a compromise of a cloud service provider, managed service provider, other third-party data hosting provider, or a supply chain compromise.

Each test is about impact, which means it can only be answered with facts about scope: which systems, which data, which processes, since when. That is the work of detection and investigation, and it has to happen inside the 72 hours.

Decision flow

The flow below shows the order of decisions after an incident is detected. The two amber boxes are the statutory clocks.

CIRCIA decision flow, based on the statute (6 U.S.C. 681b) and the April 2024 proposed rule. Definitions and thresholds are final only when CISA publishes the final rule.

What goes in the report

CISA proposes a web-based form. Expected content for a covered cyber incident report includes:

A description of the incident, affected systems and networks, and the estimated date range of the activity.
The functional impact on operations and the impact on information.
Vulnerabilities exploited, security defenses in place, and tactics, techniques and procedures observed.
Indicators of compromise and samples of malicious software where available.
Identifying information on the threat actor, if known.
Mitigation and response actions taken, and any third parties engaged.

The proposal also requires covered entities to preserve data relating to the incident, including logs, network information and forensic images, for two years. Telemetry that sits with a vendor under a short retention window becomes a compliance problem.

Sector rules already in force

CIRCIA does not start from zero. Several sectors already report on tight clocks, and CIRCIA's substantially similar reporting exception is designed to avoid duplicate filings where agencies share information with CISA.

Rule	Who	Deadline
TSA security directives	Designated pipeline, rail and aviation operators	24 hours to CISA
NERC CIP-008-6	Bulk electric system entities	1 hour after determining a reportable incident
DFARS 252.204-7012	Defense contractors handling covered defense information	72 hours to DoD
OCC / FDIC / Fed rule	Banking organizations	36 hours to the primary regulator (details)

Public companies face a separate disclosure duty under SEC Form 8-K Item 1.05, with a four business day clock that runs from the materiality determination. A single incident can trigger CIRCIA, a sector rule and the SEC at once. See the SEC cybersecurity disclosure guide.

EU Cyber Resilience Act: the 24-hour early warning

US manufacturers that sell hardware or software products into the European Union have an additional clock. Since September 11, 2026, Article 14 of the EU Cyber Resilience Act requires manufacturers of products with digital elements to notify an actively exploited vulnerability or a severe incident affecting product security through ENISA's single reporting platform:

24 hours: early warning after becoming aware.
72 hours: fuller notification with available detail.
14 days after a corrective measure is available (vulnerabilities), or one month (severe incidents): final report.

The CRA is aimed at product security rather than the manufacturer's own network, but the operational requirement is the same: know about active exploitation within hours.

Making 72 hours achievable

Seventy-two hours sounds generous until the timeline is mapped. A realistic breakdown for a mid-size organization without round-the-clock monitoring:

Detection delay. An alert fires on Friday evening and is reviewed Monday morning. More than half of the window is gone.
Triage and scoping. Logs are spread across tools, some with seven-day retention. Establishing which systems are affected takes a day.
Decision. Legal, the CISO and business owners need to agree that the substantial threshold is met. Without a clear fact pattern, the meeting is postponed.
Reporting. The CISA form asks for indicators, TTPs and impact that nobody has written down yet.

Managed Detection and Response shortens the first two steps directly: analysts triage around the clock and scope from raw telemetry. It also shortens the last two by producing the timeline, indicators and impact statement as part of the investigation, rather than after it.

CIRCIA readiness checklist

Confirm, with counsel, whether you meet the size standard or a sector-based criterion.
Define who decides "reasonable belief" and "substantial", and who can sign the report out of hours.
Ensure 24/7 triage of high-severity alerts, with an escalation target measured in minutes.
Centralize logs from identity, endpoint, network, cloud and OT sources, under your control.
Set retention to at least two years for incident-relevant data, in line with the proposed preservation rule.
Pre-draft the CISA report fields as an incident runbook template.
Add a ransom payment decision step with a 24-hour reporting task attached.
Map overlaps with TSA, NERC, DFARS, banking and SEC duties so one fact pattern feeds every report.
Run a tabletop exercise against the 72-hour clock at least once a year.

Frequently asked questions

What is the CIRCIA 72-hour reporting deadline?

Under the Cyber Incident Reporting for Critical Infrastructure Act of 2022, a covered entity must report a covered (substantial) cyber incident to CISA no later than 72 hours after it reasonably believes the incident has occurred. The obligation takes effect when CISA's final rule becomes effective.

Is CIRCIA reporting mandatory today?

Not yet. The statute is law, but the reporting duties apply only once CISA publishes and puts into effect a final rule. CISA proposed the rule in April 2024 and has since moved its target date several times, most recently to September 2026. Reporting to CISA remains voluntary until then, while sector rules such as TSA security directives, NERC CIP-008 and DFARS 252.204-7012 already apply.

When does the 72-hour clock start?

The clock starts when the entity reasonably believes a covered cyber incident has occurred, not when the investigation is complete. The proposed rule notes that some preliminary analysis may be needed to reach that belief, but it should not take long. Slow triage therefore consumes the reporting window.

Do I need to report a ransom payment if the attack was not substantial?

Yes. The 24-hour ransom payment report is a separate obligation. It applies to a covered entity that makes a ransom payment as a result of a ransomware attack, whether or not the underlying incident meets the substantial threshold.

What happens if a covered entity does not report?

CISA can issue a request for information. If the entity does not respond, CISA can issue a subpoena and refer non-compliance to the Attorney General, who may bring a civil action to enforce it. Information submitted is protected from use in most regulatory enforcement actions against the reporting entity.

Does reporting to another agency satisfy CIRCIA?

Potentially. CIRCIA contains a substantially similar reporting exception: where a covered entity is already required to report substantially similar information to another federal agency within a substantially similar timeframe, and CISA has an agreement in place with that agency, a separate CISA report may not be required.

Sources

This guide is general information on US regulatory requirements as of the review date above. It is not legal advice. Rules in this area are changing; confirm current obligations with counsel.

CIRCIA 72-hour reporting: what critical infrastructure must report to CISA