Tracker record · Federal · Proposed rule
CIRCIA incident reporting rule
The Cyber Incident Reporting for Critical Infrastructure Act's reporting rule, in CISA rulemaking: covered-entity and covered-incident scope, reporting timelines, and the relationship to sector and state notice duties. Final rule not yet issued; rulemaking status is the status.
Status
- Legal status
- Not in effect; final rule under OMB review since October 1, 2026 (CISA town halls on the proposal announced February 13, 2026; final rule sent to OMB October 1, 2026)
- Allegation or finding
- Proposal (not law)
- Applicability
- Covered critical infrastructure entities
- Enforceability
- Not in effect
- Procedural posture
- CISA rulemaking in progress
- Law checked through
- October 12, 2026
- Citation
- 6 U.S.C. 681 et seq.; proposed rule 89 Fed. Reg. 23644 (April 4, 2024)
- Source
- 6 U.S.C. 681 et seq.; 89 Fed. Reg. 23644 (April 4, 2024); Steptoe on CIRCIA
Procedural events
- 2026-10-01: Final rule sent to OMB for review
Related guides
- Public Company and Sector Cybersecurity Disclosure
- Incident Response, Ransomware, and Recovery
- Federal and Multistate Breach Duties