What Is
What Is CIRCIA?
The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), 6 U.S.C. 681 et seq., is the federal statute for incident reporting by covered critical infrastructure entities. The Cybersecurity and Infrastructure Security Agency proposed the reporting rule at 89 Fed. Reg. 23644 on April 4, 2024.
Status: the final rule is under review at the Office of Management and Budget, submitted October 1, 2026, and the reporting requirements are not operative. Which entities are covered, which incidents are reportable, and what timelines apply depend on the final rule, so no reporting duty should be treated as in effect until the rule is published.
Pinpoint: 6 U.S.C. ยง 681 et seq.; 89 Fed. Reg. 23644 (April 4, 2024). Related term: CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act).