CISA CIRCIA: critical infrastructure incident reporting, explained

CIRCIA itself is a real, enacted statute — it is not proposed. What's still pending is the implementing regulation that would actually impose reporting duties and attach deadlines, penalties and definitions. CISA's rulemaking has repeatedly missed its own targets: the statute's original deadline for a final rule was October 2025, an internal target slipped to May 2026, a further target of September 2026 was also missed, and the draft final rule only reached OIRA for review on 1 October 2026 (tracked under RIN 1670-AA04, "Final Rule" stage). OIRA review can take up to 90 days or longer, after which the rule would still need Federal Register publication and an effective date — CISA's page notes that date is likely to be at least 60 days after publication. Until then, every number and definition in this guide is a proposal, not a binding requirement.

Per the NPRM, any entity in one of 16 critical infrastructure sectors (as the sectors are defined under Presidential Policy Directive 21) would be covered if it meets either of two tests:

The sector-based criteria differ by sector. CISA's NPRM overview gives examples including: Healthcare and Public Health — owns/operates a large or critical-access hospital, or manufactures certain essential drugs or Class II/III medical devices; Energy — required to report to the North American Electric Reliability Corporation or to the Department of Energy under OE-417; Information Technology — is an original equipment manufacturer or vendor of operational technology hardware or software components, or knowingly supports federal government IT; Water — owns/operates a community water system or publicly owned treatment works serving 3,300 or more people; and Emergency Services or Government Facilities — serves a population of 50,000 or more. Commercial Facilities, Dams, and Food and Agriculture have no sector-specific criteria proposed — coverage for those sectors runs through the size-based test alone.

The four substantial-incident impacts, per the NPRM: (1) a substantial loss of confidentiality, integrity or availability of the entity's information system or network; (2) a serious impact on the safety and resilience of its operational systems and processes; (3) a disruption of its ability to engage in business or industrial operations, or deliver goods or services; or (4) unauthorized access to its information system, network, or nonpublic information, facilitated through a compromise of a cloud service provider, managed service provider or other third-party data host, or through a supply-chain compromise.

Excluded even if one of those impacts occurs: lawfully authorized activity by a U.S. or state/local/tribal/territorial government entity, an event perpetrated in good faith at the specific request of the system owner or operator (e.g. authorized penetration testing), and a bare threat to disrupt used as extortion with no actual impact.

CISA's fact sheet gives illustrative examples on both sides. Likely to qualify: a DDoS attack that renders services unavailable to customers for an extended period; a ransomware attack that locks a covered entity out of its industrial control system; unauthorized access to a business system caused by a tampered automatic software update or compromised managed-service-provider credentials. Likely not to qualify: a brief outage of a non-critical public-facing website; a single phished credential blocked by enforced multi-factor authentication; malware that antivirus software quarantines before it executes; blocked phishing attempts or failed login attempts; routine vulnerability scanning with no evidence of penetration.

Covered entities would also have to preserve data and records relevant to the incident or payment — indicators of compromise, relevant log entries, forensic artifacts, and communications with the threat actor — starting from the date of the reasonable belief (or payment) and continuing until two years after the last related CIRCIA report, even if the entity itself is exempt from direct reporting under a "substantially similar reporting" exception to another federal agency.

Per the NPRM, every CIRCIA report would identify the covered entity (name, entity type, physical address, sector(s), other identifiers) and provide contact information. Incident and ransom-payment reports would additionally need a description of the incident (impacts, exploited vulnerabilities, tactics/techniques/procedures, indicators of compromise), information on the perpetrator's identity if known, and mitigation/response activities — plus, for ransom payments specifically, the demand and payment details. Reports would go through a single, dynamic, web-based CIRCIA Incident Reporting Form; a covered entity could designate a third party to report on its behalf, but compliance responsibility stays with the covered entity itself. The NPRM also proposes that CIRCIA reports be treated as protected commercial/financial/proprietary information, exempt from FOIA disclosure, inadmissible as evidence from the act of submission alone, and shielded by a "no cause of action" liability protection for the submission itself.