CIRCIA Cyber Incident Reporting, Explained: The 72-Hour and 24-Hour CISA Clocks

Key takeaways

• The two deadlines are set by statute, not by the pending rule. Covered entities report covered cyber incidents within 72 hours after reasonably believing the incident occurred, and ransom payments within 24 hours after the payment is made. 6 U.S.C. 681b(a) says so directly.
• Nothing is in force yet. The proposed rule landed April 4, 2024. The final rule missed the statutory October 2025 deadline and CISA's September 2026 target, and the draft final rule moved to OMB review on October 1, 2026. Reporting starts only when the final rule takes effect, on a date the rule itself will set.
• Coverage is broad and thresholded. The proposal covers the 16 critical infrastructure sectors, limited to entities above the SBA small business size standard or on a list of 16 sector-based triggers, from hospitals with 100 or more beds to water systems serving more than 3,300 people. CISA's preliminary estimate was roughly 316,000 entities.
• "Substantial" is judged on impact, not attribution. Loss of confidentiality, integrity, or availability; serious impact on operational safety and resiliency; disruption of operations or delivery; or unauthorized access through a cloud, managed service provider, or supply chain compromise. You do not need to know who did it or how.
• The clocks stack and the duty continues. CIRCIA does not displace state, SEC, sector, or contractual duties, and the duty to supplement runs until you tell CISA the incident has been fully mitigated and resolved.

What CIRCIA is, and where the rule stands right now

CIRCIA is the Cyber Incident Reporting for Critical Infrastructure Act of 2022, signed into law on March 15, 2022. It directs CISA to build the first broad, mandatory federal channel for cyber incident and ransom payment reporting from critical infrastructure, and the two deadlines live in the statute itself.

The rulemaking has been slow and public. CISA published its proposed rule (the NPRM) on April 4, 2024 at 89 FR 23644 and took comments through July 3, 2024. The statute required the final rule within 18 months of the NPRM, which meant October 2025. That deadline passed, a May 2026 target passed too after DHS funding lapses slowed the work and pushed public town halls into June 2026, and the September 2026 target in the 2026 Unified Agenda passed as well. On October 1, 2026, CISA moved the draft final rule to the Office of Management and Budget for review, the last major review step before publication. The draft text is not public.

The bottom line as of mid-October 2026: no final rule, and CISA's own FAQ states that no reports are required until the final rule goes into effect, on the effective date the rule itself will identify. Anyone quoting a compliance date today is guessing. Until the rule lands, CISA asks organizations to share incident information voluntarily at cisa.gov/report.

Who is covered: the covered-entity test

The statute defines a covered entity as an entity in a critical infrastructure sector that satisfies the definition the final rule sets. The sectors are the familiar 16: chemical, commercial facilities, communications, critical manufacturing, dams, defense industrial base, emergency services, energy, financial services, food and agriculture, government services and facilities, healthcare and public health, information technology, nuclear, transportation systems, and water and wastewater.

The NPRM proposed a two-gate test. Gate one: the entity exceeds the Small Business Administration size standard for its industry code. Gate two: the entity meets any one of 16 sector-based triggers, regardless of which sector it considers itself part of. Those triggers sweep in, among others: chemical facilities regulated under CFATS; communications providers; DoD contractors reporting under DFARS 252.204-7012; emergency services and local governments serving 50,000 or more people; electric entities reporting under NERC CIP or DOE's OE-417 form; regulated banks and credit unions; school districts with 1,000 or more students and Title IV colleges; hospitals with 100 or more beds or critical access hospitals; software with privileged access and vendors serving federal networks; NRC-licensed nuclear operators; TSA-regulated rail, pipeline, and aviation entities; vessels under the Maritime Transportation Security Act; and water systems serving more than 3,300 people.

CISA's preliminary estimate put the count near 316,000 entities, and that breadth drew most of the criticism in the 2024 comments. The June 2026 town halls were explicitly about refining the rule's scope and burden, so expect the final coverage test to move. When the final rule lands, the operative test is whatever it says.

The two clocks and when each starts

The 72-hour clock starts at reasonable belief, not at the end of the investigation. CISA's preamble recognizes that entities may need limited time for preliminary analysis before forming a reasonable belief, and that the cause need not be known: if the impact criteria are met, report once you reasonably believe the impacts resulted from activity without lawful authority. The statute also bars CISA from requiring reporting any earlier than 72 hours after reasonable belief. Because facts evolve, the report is built for partial information: file what is available, then supplement.

The 24-hour clock starts at disbursement. Not at the extortion demand, not at the decision to pay: the clock runs from the moment the payment has been disbursed, including a payment made for you by a third party. The duty stands even if the ransomware attack is not a covered cyber incident: pay a ransom for an attack that misses the substantial threshold and the 24-hour clock still runs. If you already filed an incident report for the same incident, the payment goes in as a Supplemental Report within 24 hours of disbursement. Ransom decisions usually land inside the first 24 hours of an incident, so track the disbursement timestamp with the same care as the discovery timestamp.

The duty does not end at the first report. Supplemental Reports are due promptly whenever substantial new or different information appears, and the obligation runs until you notify CISA that the incident has concluded and been fully mitigated and resolved.

What makes an incident "substantial"

A covered cyber incident is a substantial cyber incident experienced by a covered entity. The statute set a floor and the NPRM proposed a four-prong test. An incident is substantial if it leads to any of the following:

1. A substantial loss of confidentiality, integrity, or availability of the entity's information system or network;
2. A serious impact on the safety and resiliency of operational systems and processes;
3. A disruption of the entity's ability to engage in business or industrial operations, or to deliver goods or services;
4. Unauthorized access to systems or nonpublic information through a compromise of a cloud service provider, managed service provider, or other third-party hosting provider, or through a supply chain compromise.

The test is cause-agnostic. Ransomware, a denial-of-service attack, or exploitation of a zero-day counts if the impacts land, and CISA has said you need not confirm the cause before reporting. Excluded are lawful government activity, incidents caused in good faith at the system owner's request, and extortion threats where no actual incident occurred.

Operationally this is a severity-classification question, not a forensics question. The four prongs belong in the severity matrix of your response plan, and a decision that an incident falls below the bar should be written down at the time.

How reports are made and what they must contain

Reports go through a web-based CIRCIA Incident Reporting Form on CISA's website, or another manner CISA approves. A third party can file for you: the statute names incident response companies, insurers, service providers, information sharing organizations, and law firms. Your responsibility does not move with the filing, and the submission includes an attestation that the filer is authorized to act for you.

Every report starts with the same core: entity identity, state of incorporation, trade names, address, parent company, the sector you consider yourself part of, an internal tracking number, and contacts. The incident report then asks for the affected systems and their functions and locations; dates for detection, start, and end, plus the timeline of compromised system communications and the suspected duration of unauthorized access; operational and economic impact; the categories of information accessed; exploited vulnerabilities and the defenses in place; the tactics, techniques, and procedures used; indicators of compromise; malware samples if you hold them; and your response actions, including law enforcement engagement. The payment report adds the payment specifics: date, amount and type of assets, the original demand, payment instructions including addresses and transaction identifiers, and the outcome, including whether a delivered decryption capability worked. Required information is only due to the extent it is available, which is what Supplemental Reports are for.

Preservation is its own requirement. Data and records tied to the incident or payment, including threat actor communications, logs, forensic images, exfiltration evidence, and payment records, must be preserved from the earlier of reasonable belief or disbursement, for no less than two years from the most recently required report.

On enforcement, the statute sets no schedule of civil fines for a late report. CISA's ladder is a request for information when it has reason to believe you failed to report, 72 hours to respond, then an administrative subpoena, then referral to the Attorney General for a civil action to enforce it, where noncompliance can be punished as contempt. Alongside that sit referrals for acquisition penalties, suspension, and debarment. A materially false statement in a report or subpoena response carries penalties under 18 U.S.C. 1001, a fine or up to five years imprisonment. CISA must weigh how hard it is to determine that a covered cyber incident occurred, and state, local, tribal, and territorial entities are excluded from the subpoena provisions.

How the CIRCIA clocks stack with the other clocks

CIRCIA has an explicit savings provision: it does not supersede or limit the authority of any other agency to regulate your cybersecurity. One incident can trip state breach notification laws for residents, SEC Item 1.05 disclosure within four business days of a materiality determination if you are listed, the financial services notification clocks if you are regulated there, plus sector rules and contractual duties like the DoD report required by DFARS. After the effective date, federal agencies that receive incident reports must share them with CISA within 24 hours, which is the plumbing for the only relief valve: where CISA has an agreement with another federal agency, an entity already required to report substantially similar information within a substantially similar timeframe to that agency is exempt, and CISA will keep a public catalog of those agreements. That exception is federal-only. Each clock keeps its own trigger, so track them separately: CIRCIA from reasonable belief, the SEC clock from the materiality determination, the banking clock from determination, and most state clocks from discovery.

What this means for your incident response plan

• Name who forms the reasonable belief. The 72-hour clock runs from reasonable belief, so the plan must say who forms it for the company. That call usually belongs to the incident commander with counsel in the loop; leave it unnamed and the debate about when the clock started happens during the incident.
• Build the ransom path now. A payment, including one made for you by a third party, starts a 24-hour clock of its own. The plan needs a documented decision and disbursement trail: who approves payment, who records the disbursement time, and who files the report.
• Pre-assemble the report. The form's static fields can be filled in today. Pre-write the incident skeleton so the first filing is an editing job, not a drafting one.
• Start preservation at the trigger. Preservation begins at reasonable belief or disbursement and runs at least two years past the last required report. Write that trigger into the breach response checklist so forensics holds data from day one.
• Keep the supplementals moving. Assign an owner for the substantial-new-information judgment and for the closure notice; the duty runs until CISA is told the incident is fully resolved.
• Update the matrix when the rule lands. Watch CISA's CIRCIA page, then re-check the coverage test, the form, and each clock against the incident response plan template. Prepare against the NPRM now, because it is the only published blueprint.

Frequently asked questions

Is CIRCIA reporting required right now? No. As of mid-October 2026 the final rule is unpublished and in OMB review. CISA's FAQ says no reports are required until the final rule goes into effect, on the date the rule itself will identify. Until then, CISA invites voluntary reporting at cisa.gov/report.

When does the 72-hour clock start? When the entity reasonably believes a covered cyber incident has occurred, not when the investigation ends or the cause is confirmed. CISA allows limited time for preliminary analysis before belief forms, and the statute bars requiring reporting any earlier than 72 hours after belief. Partial facts are expected: file what you know, then supplement.

We paid a ransom for an attack that is not a covered cyber incident. Do we still report? Yes. The 24-hour payment report applies even when the ransomware attack would not qualify as a covered cyber incident, and payments made on your behalf count too. If you already filed an incident report for that incident, the payment goes in as a Supplemental Report within 24 hours of disbursement.

Does CIRCIA replace our other notification duties? No. The savings provision keeps every other regime intact: state statutes, the SEC's Item 1.05, sector regulators, and contracts all still run. The only carve-out is the federal substantially-similar exception, and only where CISA has an agreement and sharing mechanism in place with the receiving agency.

Free download: every other clock on one printable page: Breach Notification Clocks cheat sheet (PDF, one page) →