CIRCIA 2026: 72-Hour Incident Reporting, Ransom Payments and Readiness Checklist

The Cyber Incident Reporting for Critical Infrastructure Act of 2022, commonly known as CIRCIA, is building a new federal cyber-incident reporting regime for covered critical-infrastructure entities in the United States.

But one point is essential in September 2026:

Mandatory CIRCIA reporting is not yet in effect.

CISA says the regulatory reporting requirements will not become mandatory until the CIRCIA final rule takes effect. Until then, organizations may continue to share cyber-incident information with CISA voluntarily.

That does not mean organizations should wait.

The statute and CISA’s proposed rule already establish the core reporting model:

• a covered cyber incident report within 72 hours after a covered entity reasonably believes the covered cyber incident occurred;
• a ransom payment report within 24 hours after the ransom payment is disbursed;
• supplemental reporting as material new information becomes available;
• provisions for third parties to submit reports on behalf of covered entities.

The 2024 NPRM states the proposed 72-hour and 24-hour deadlines explicitly.

CISA continued consulting stakeholders in 2026. A revised Federal Register notice scheduled additional town halls beginning 15 June 2026, including sector-specific sessions, to gather more input on the proposed rule’s scope, applicability, burdens and implementation.

For security teams, legal departments and executives, the practical question is therefore not:

“Do we have to report under CIRCIA today?”

The better question is:

“If the final rule took effect tomorrow, could we identify a covered incident, establish the reporting clock and assemble the required information within 72 hours?”

---

CIRCIA 2026 at a Glance

Requirement	Current position
CIRCIA statute	Enacted in 2022
NPRM	Published in 2024
2026 stakeholder consultation	Continued through revised town halls
Final rule	Not yet effective
Mandatory CIRCIA reporting today	No
Proposed covered cyber-incident report	Within 72 hours
Proposed ransom-payment report	Within 24 hours
Supplemental reporting	Required under proposed framework when material new information becomes available
Voluntary reporting to CISA	Available before final rule

CISA’s official fact sheet is explicit that the reporting requirements do not apply until the final rule’s effective date.

What Is CIRCIA?

Congress enacted CIRCIA in 2022 to improve federal visibility into significant cyber incidents affecting U.S. critical infrastructure.

The purpose is broader than collecting compliance forms.

Timely reporting can help CISA:

• identify patterns across sectors;
• understand attacker activity;
• provide assistance to victims;
• warn other organizations;
• improve national cyber situational awareness.

CISA encourages voluntary incident information sharing even before the mandatory reporting regime begins because timely information can help the agency identify trends and warn other potential victims.

CIRCIA therefore sits at the intersection of:

incident response + regulatory reporting + intelligence sharing + critical-infrastructure resilience.

---

Which Organizations Could Be Covered?

CIRCIA is aimed at covered entities within the U.S. critical-infrastructure ecosystem rather than every organization operating in the United States.

The precise regulatory coverage rules are part of the rulemaking process.

CISA’s 2026 consultations continued to examine issues involving:

• sector criteria;
• size criteria;
• entity applicability;
• reporting burden;
• managed-service relationships;
• other aspects of the proposed scope.

That makes it important to distinguish between:

statutory direction
and
final regulatory scope.

Organizations should avoid claiming certainty about coverage before the final rule is published.

---

Cybersecurity Time CIRCIA Scope Screening

A preliminary coverage review should ask:

Question	Why it matters
Do we operate in a U.S. critical-infrastructure sector?	Starting point for potential coverage
What legal entities actually operate the service?	Reporting may attach to specific entities
What size thresholds might apply?	Proposed rule uses regulatory coverage criteria
Do subsidiaries perform critical functions?	Group structures can complicate scope
Do we provide services to critical infrastructure?	Supplier/MSP relationships may matter
Which incidents could meet the covered-incident definition?	Determines escalation need
Who owns CIRCIA readiness internally?	Prevents delay when rule becomes effective

This is a preparation framework, not a legal determination of CIRCIA coverage.

The 72-Hour Covered Cyber Incident Rule

The proposed CIRCIA framework requires a covered entity to report a covered cyber incident to CISA no later than 72 hours after the entity reasonably believes the covered cyber incident occurred.

That wording matters.

The proposed trigger is not necessarily:

• when the attacker first gained access;
• when the SOC first received an alert;
• when executives were briefed;
• when the forensic investigation was completed.

The relevant regulatory concept is when the organization reasonably believes that a covered cyber incident has occurred.

That means organizations need a defensible internal decision process.

---

Detection, Awareness and Reporting Trigger Are Different

One of the best improvements organizations can make now is to record several timestamps separately.

Technical detection

When did monitoring or another source first identify unusual activity?

Example:

02:13 — EDR detects suspicious credential dumping.

Incident confirmation

When did the incident-response team determine that malicious activity was occurring?

Example:

05:40 — IR confirms unauthorized administrator activity.

CIRCIA assessment

When did the organization reasonably believe the event met the relevant covered-incident criteria?

Example:

11:20 — Legal/security classification team determines the event is likely a covered cyber incident.

These timestamps can be different.

A good incident chronology should preserve all of them.

For practical timeline documentation, see Cybersecurity Time’s Cybersecurity Incident Response Timeline.
Cybersecurity Incident Response Timeline

And the Data Breach Timeline Template can help teams document decisions, evidence and reporting milestones.
Data Breach Timeline Template

The 24-Hour Ransom Payment Rule

CIRCIA also creates a separate reporting requirement for ransom payments.

Under the proposed rule, a covered entity would submit a Ransom Payment Report no later than 24 hours after the ransom payment has been disbursed.

This reporting clock is different from the covered cyber-incident clock.

That distinction matters because organizations sometimes treat ransom-payment decisions as primarily:

• legal;
• insurance;
• finance;
• executive

issues.

Under CIRCIA, security/regulatory reporting also becomes part of that decision path.

---

When Both Incident and Ransom Payment Reporting Apply

The proposed rule also contemplates a joint covered cyber incident and ransom payment report.

Where a covered entity experiences a covered incident and makes a ransom payment within the relevant 72-hour incident window, the proposed framework permits a joint report under specified conditions.

This means ransomware playbooks should connect:

incident response → executive decision → legal review → insurer interaction → financial payment process → CISA reporting

rather than treating each activity as a separate workflow.

---

CIRCIA Reporting Timeline

A simple operational model looks like this:

Event	Proposed reporting action
Suspicious activity detected	Investigate
Incident reasonably believed covered	Start/confirm CIRCIA workflow
Covered cyber incident	Report within 72 hours
Ransom payment made	Report within 24 hours of payment
Material new information discovered	Supplemental reporting
Incident response continues	Maintain living evidence record

The mandatory workflow becomes enforceable only once the final rule becomes effective.

---

What Could Count as a Covered Cyber Incident?

The exact final regulatory definition remains subject to the final rule.

The NPRM and 2026 consultations have been focused on defining which incidents should trigger reporting without creating unnecessary reporting of routine events.

This is important because critical-infrastructure organizations experience many events that are not necessarily serious enough to justify federal mandatory reporting:

• routine phishing;
• blocked scanning;
• unsuccessful exploit attempts;
• minor malware detections;
• limited outages.

A well-designed CIRCIA program should therefore include a classification function, not simply forward every SOC alert to CISA.

---

Cybersecurity Time CIRCIA Decision Matrix

Question	Example	Action
Is there a confirmed cyber incident?	Unauthorized access detected	Continue assessment
Is our organization likely covered?	Critical infrastructure operator	Apply CIRCIA workflow
Does the event meet likely covered-incident criteria?	Serious operational compromise	Escalate
When did we reasonably reach that conclusion?	14:10	Record trigger timestamp
Was ransom paid?	Payment approved/disbursed	Start 24-hour reporting workflow
Are material facts still changing?	New systems identified	Prepare supplemental update
Does another regulatory rule also apply?	SEC disclosure obligation	Run parallel workflow

This is a practical readiness tool, not CISA’s official classification test.

---

First 72 Hours Under CIRCIA

One reason to prepare now is that a 72-hour reporting period passes quickly during a serious cyber incident.

Hours 0–4: Establish Control

• activate incident response;
• preserve logs and volatile evidence;
• assign incident commander;
• identify affected systems;
• establish legal/compliance contact;
• record the initial timeline.

Hours 4–12: Assess Scope

Determine:

• affected services;
• operational disruption;
• unauthorized access;
• third-party involvement;
• customer impact;
• likely attacker activity;
• likely CIRCIA relevance.

Hours 12–24: Establish Reporting Position

Ask:

• Are we likely a covered entity?
• Does the incident appear reportable?
• When did we reasonably reach that conclusion?
• Does another reporting regime apply?
• Is ransom being discussed or paid?

Hours 24–48: Build Report Package

Collect:

• incident chronology;
• affected systems;
• impact;
• mitigation;
• indicators;
• third-party facts;
• contact information;
• known/unknown facts.

Hours 48–72: Review and Submit

• validate facts;
• clearly distinguish confirmed facts from estimates;
• obtain appropriate legal/regulatory review;
• submit through the applicable CISA mechanism once the mandatory regime is effective.

The objective should not be perfect forensic certainty.

It should be a timely, defensible account of what is known.

---

Build a Report-Ready Evidence Package

Your current article is correct to focus on evidence, but this can be made more specific.

A strong CIRCIA evidence package should include:

Timeline

• detection;
• incident confirmation;
• classification;
• containment;
• recovery;
• ransom-payment decisions.

Systems

• assets affected;
• networks;
• applications;
• cloud environments;
• operational technology if applicable.

Impact

• service interruption;
• customer effects;
• safety implications;
• data access/exfiltration;
• financial consequences.

Threat information

• attacker behavior;
• indicators of compromise;
• known malware;
• persistence.

Third parties

• MSP involvement;
• cloud-provider involvement;
• supplier dependencies.

Decision record

• who made reportability decisions;
• when;
• based on what information.

This evidence should be a living incident record, not a report assembled from memory 70 hours after detection.

---

Supplemental Reporting Matters

Cyber incidents evolve.

At hour 12, the organization may believe:

only one system is affected.

At hour 50, investigators may learn:

credentials were stolen and three environments were accessed.

A staged regulatory regime needs a way to account for that changing knowledge.

The CIRCIA framework therefore includes supplemental-reporting concepts so material new information can be provided as investigation continues.

Organizations should build their incident record so updates are easy to produce.

---

Who Should Decide Whether an Incident Is Reportable?

This should never be an improvised decision.

A sensible classification group might include:

• incident-response lead;
• security leadership;
• legal counsel;
• compliance/regulatory affairs;
• business/service owner.

For high-impact incidents, executive leadership may also become involved.

The key is not the exact organizational chart.

The key is predefined authority.

---

CIRCIA Reporting RACI

Activity	Primary owner	Supporting teams
Detection	SOC	IT/OT
Technical investigation	Incident Response	Forensics/vendor
CIRCIA scope assessment	Legal/Compliance	Security
Incident classification	Security + Legal	Business
CISA report preparation	Compliance/Legal	IR
Ransom-payment decision	Executive/Legal	Finance/Insurance
24-hour payment report	Authorized reporting owner	Legal/Finance
Supplier evidence	Third-Party Risk	Procurement
Supplemental reporting	Reporting owner	IR/Legal

This is a practical model rather than a CISA-prescribed governance structure.

---

Third Parties Can Make the Reporting Clock Harder

Modern critical infrastructure depends heavily on:

• cloud providers;
• MSPs;
• SaaS providers;
• security vendors;
• telecommunications providers;
• software suppliers.

A serious incident may first be discovered by one of those companies rather than the covered entity itself.

That creates a simple problem:

A company cannot report what its supplier has not told it.

Your existing article rightly emphasizes this issue.

Contractual notification requirements should therefore be shorter than the regulatory deadline.

For example, a company expecting to meet a 72-hour federal reporting clock should not accept a supplier clause saying:

“Supplier will notify customer within five business days.”

---

Supplier Incident Clauses to Review

Contracts should address:

• notification time;
• 24/7 security contacts;
• evidence preservation;
• indicators of compromise;
• affected services;
• subcontractor incidents;
• forensic cooperation;
• regulator assistance;
• customer communication;
• updates as new facts emerge.

Use Cybersecurity Time’s Supplier Cybersecurity Contract Template to support this work.
Supplier Cybersecurity Contract Template

For broader supplier due diligence, use the Vendor Security Questionnaire Template.
Vendor Security Questionnaire Template

---

Reporting Through a Third Party

The proposed CIRCIA framework also contemplates reports submitted on behalf of covered entities by third parties.

That may include certain relationships with:

• incident-response providers;
• legal representatives;
• other authorized reporting parties.

But outsourcing submission does not eliminate the covered entity’s need to:

• detect the incident;
• classify it;
• gather accurate information;
• control deadlines.

Third-party reporting should therefore be documented before an emergency.

---

CIRCIA Will Overlap With Other Cyber Reporting Rules

This may become one of the most difficult operational issues.

One cyber event can potentially trigger:

• CIRCIA;
• SEC disclosure;
• sector-regulator reporting;
• state breach laws;
• contractual notification;
• law-enforcement reporting;
• insurance notification.

CISA’s 2026 stakeholder process explicitly continued examining harmonization with other reporting requirements, which shows the government recognizes this problem.

The best approach is:

one incident record → several regulatory outputs

rather than creating a completely separate investigation for each regulator.

---

CIRCIA vs SEC Cyber Incident Disclosure

The rules answer different questions.

CIRCIA

The proposed CIRCIA framework focuses on covered cyber incidents affecting covered critical-infrastructure entities and uses the statutory 72-hour model.

SEC

The SEC requires public companies to disclose a material cybersecurity incident on Form 8-K within four business days after determining the incident is material.

The SEC clock is therefore tied to materiality determination, not CIRCIA’s proposed covered-incident trigger.

A public company subject to both regimes should not assume:

CIRCIA report = SEC disclosure complete.

For practical SEC procedures, see Cybersecurity Time’s SEC Cyber Incident Disclosure Checklist.
SEC Cyber Incident Disclosure Checklist

---

Example: One Incident, Multiple Timelines

Consider a hypothetical critical-infrastructure public company.

Monday 08:00

Threat actor gains privileged access.

Monday 14:00

SOC detects activity.

Monday 20:00

Investigation confirms a serious compromise.

Tuesday

Organization reasonably believes the event is a covered cyber incident.

A future CIRCIA deadline may be running from the appropriate regulatory trigger under the final rules.

Wednesday

Additional facts suggest significant operational impact.

Thursday

Company determines the incident is material under SEC standards.

That could start a separate four-business-day SEC disclosure clock.

The same attack therefore produces multiple decision points.

---

What About Ransomware?

Ransomware deserves special attention because it can trigger both:

• covered cyber-incident reporting; and
• ransom-payment reporting.

A ransomware playbook should record:

• encryption activity;
• data theft;
• operational disruption;
• ransom demand;
• payment decision;
• payment time;
• payment method;
• third-party negotiators;
• insurer involvement.

CISA’s #StopRansomware Guide remains a useful defensive resource for preparing, responding and recovering from ransomware attacks.

CISA #StopRansomware Guide

---

A CIRCIA Ransom-Payment Workflow

Demand received

Preserve:

• ransom note;
• communications;
• cryptocurrency address;
• timing.

Decision process

Bring together:

• legal;
• executive leadership;
• security;
• finance;
• insurance;
• law enforcement where appropriate.

Before payment

Confirm:

• decision authority;
• sanctions/other legal checks as appropriate;
• payment documentation.

Payment occurs

Record exact:

• time;
• amount;
• payment instrument;
• recipient information available.

Reporting

Prepare the 24-hour CIRCIA ransom-payment report if the entity and event are covered once the mandatory rule is effective.

---

Do Not Wait for the Final Rule to Improve Detection

A short reporting clock creates pressure long before the regulatory team starts drafting.

If it takes:

48 hours to detect

18 hours to investigate

12 hours to involve legal

then the organization has very little time left.

This is why CIRCIA readiness should include operational detection metrics.

Relevant measures include:

• mean time to detect;
• mean time to investigate;
• mean time to classify;
• mean time to escalate.

See Cybersecurity Time’s Mean Time to Detect guide.
Mean Time to Detect

---

Cybersecurity Time CIRCIA Readiness Matrix

Area	Readiness question	Evidence
Scope	Are we likely covered?	Scope assessment
Assets	Which critical services do we operate?	Asset/service inventory
Detection	Can we recognize serious incidents quickly?	SOC metrics
Classification	Who decides reportability?	Incident RACI
Timeline	Are regulatory timestamps recorded?	Incident chronology
Reporting	Can we assemble facts within 72h?	Draft report template
Ransom	Can payment facts be captured within 24h?	Ransom workflow
Suppliers	Will vendors notify us rapidly?	Contract clauses
Overlap	Which other regulators apply?	Regulatory matrix
Updates	Can supplemental reports be produced?	Living incident record

---

Run a CIRCIA Tabletop Before the Rule Takes Effect

The current period gives organizations something valuable:

time to rehearse without a mandatory CIRCIA filing clock running.

CISA’s own materials confirm that the mandatory reporting regime is not yet effective.

Use that time.

Example exercise

At 09:00 Monday, a cloud provider informs your organization that attackers accessed an administrative account supporting a critical service.

At 13:00, investigation confirms unauthorized data access.

At 17:00, the provider reveals that credentials were stolen three days earlier.

At 22:00, the attacker sends a ransom demand.

Ask your team:

1. Are we likely a covered entity?
2. Is this likely a covered cyber incident?
3. What timestamp starts our internal CIRCIA assessment?
4. Who makes that determination?
5. What facts can we confirm?
6. Which facts remain unknown?
7. Which supplier records are needed?
8. Does SEC or another regulator also apply?
9. Who would submit the CISA report?
10. What happens if a ransom payment is authorized tomorrow?

If those questions cannot be answered during a tabletop, they will be harder to answer during a real incident.

---

Common CIRCIA Preparation Mistakes

Calling the Final Rule “Effective” Before It Is

This is the biggest issue in your existing SEO title.

CIRCIA mandatory reporting is not yet effective.

Do not title the article:

CIRCIA Final Rule 2026

until there actually is a final rule.

---

Assuming the Reporting Clock Starts at Detection

The proposed covered-incident rule uses a more specific regulatory trigger.

Do not replace that with your own simplified definition.

---

Waiting for Perfect Forensics

The purpose of short cyber-reporting deadlines is early government visibility.

Incident response can continue after a report.

---

Keeping Legal Outside the Incident Process

If legal sees the incident for the first time at hour 60, the reporting process is already under unnecessary pressure.

---

Using One Supplier Notification Standard for Everything

A vendor supporting critical infrastructure may need a much faster notification requirement than an ordinary business supplier.

---

Treating SEC and CIRCIA as the Same Rule

They have different:

• scope;
• triggering standards;
• deadlines;
• reporting audiences.

---

Forgetting the Payment Clock

The 24-hour ransom-payment rule creates its own reporting event.

Security teams need visibility into payment decisions.

---

CIRCIA 90-Day Readiness Checklist

Governance

• appoint CIRCIA owner;
• appoint backup reporting owner;
• define legal/compliance participation;
• establish executive escalation.

Scope

• review likely covered-entity status;
• map subsidiaries;
• map critical services.

Incident Response

• record detection time;
• record classification time;
• establish reportability review.

Evidence

• standardize chronology;
• preserve logs;
• record system impact;
• capture supplier involvement.

Ransomware

• update ransom-payment playbook;
• record payment timestamp;
• connect finance and security workflows.

Vendors

• shorten notification deadlines;
• create 24/7 supplier contacts;
• establish forensic cooperation requirements.

Regulatory Overlap

• map SEC obligations;
• map sector requirements;
• map state notification laws where relevant.

Exercises

• run CIRCIA tabletop;
• test 72-hour report;
• test 24-hour ransom report;
• document improvements.

---

Frequently Asked Questions

Is CIRCIA mandatory today?

Not yet.

CISA states that organizations are not required to submit CIRCIA covered cyber-incident or ransom-payment reports until the final rule becomes effective.

---

Has the CIRCIA final rule been issued?

As of this September 2026 review, CISA is still in the rulemaking process. CISA held additional stakeholder town halls in 2026 concerning refinement of the NPRM’s scope and burden.

---

What is the proposed incident-reporting deadline?

A covered entity would report a covered cyber incident no later than 72 hours after it reasonably believes the covered cyber incident occurred.

---

What is the proposed ransom-payment deadline?

A covered entity would report a ransom payment no later than 24 hours after the payment is disbursed.

---

Does CIRCIA apply to every U.S. company?

No.

It concerns covered entities in the critical-infrastructure context. Exact final coverage depends on the final implementing rule.

---

Can companies voluntarily report incidents before the rule takes effect?

Yes.

CISA encourages organizations to continue voluntarily sharing cyber-event information during the rulemaking period.

---

Is CIRCIA the same as SEC cybersecurity disclosure?

No.

The SEC requires covered registrants to file Form 8-K disclosure of a material cybersecurity incident within four business days after determining the incident is material.

CIRCIA uses a different scope and reporting trigger.

---

Does changing the article title matter for SEO?

Yes in this case, because “Final Rule 2026” communicates a factual status that is not currently correct.

A more accurate title can improve trust and reduce the risk that readers immediately encounter contradictory information in the opening paragraph.

---

Final Takeaway

CIRCIA should currently be treated as a readiness program, not as an already-active mandatory reporting regime.

The final implementation details are still being completed, but the central architecture is clear enough to prepare for:

covered cyber incident → 72-hour report

ransom payment → 24-hour report

new material information → supplemental reporting

The organizations best prepared for CIRCIA will not be the ones that memorize those numbers.

They will be the organizations that already know:

• whether they are likely in scope;
• what services are critical;
• how quickly security detects serious incidents;
• who decides reportability;
• which suppliers hold essential evidence;
• who reports to CISA;
• how ransom payments are documented;
• which other regulators need parallel reports.

The correct preparation sequence is:

scope → detect → classify → document → report → update

CISA’s continued 2026 consultation means some details remain subject to change. But those uncertainties are not a reason to delay improving incident-response readiness.

A 72-hour reporting process works only if the organization can understand an incident before the clock runs out.

---

Primary External Sources

For the WordPress article, use a compact primary-source section.

CISA — CIRCIA Information and Reporting Status

CISA states that mandatory CIRCIA reporting does not apply until the final rule takes effect.

Federal Register — CIRCIA 2024 Proposed Rule

The NPRM contains the proposed 72-hour covered-incident and 24-hour ransom-payment deadlines.

Federal Register — Revised 2026 CIRCIA Town Hall Schedule

The notice confirms continued 2026 stakeholder consultation on the NPRM’s scope and burden.

SEC — Cybersecurity Risk Management, Strategy, Governance and Incident Disclosure Rule

The SEC rule provides the four-business-day disclosure timeline following a materiality determination.