A 2022 law created reporting duties still waiting on a final rule

What the document says

On 15 March 2022, the Cyber Incident Reporting for Critical Infrastructure Act became law as part of the Consolidated Appropriations Act, 2022, according to its legislative record. The statute requires covered entities in critical infrastructure sectors to report a covered cyber incident to CISA within 72 hours of reasonably believing it occurred, and to report a ransom payment within 24 hours of making it. Those duties, however, do not take effect on their own; the law directed CISA to write implementing regulations defining exactly who counts as a covered entity and what counts as a covered incident. CISA published its proposed rule on 4 April 2024, describing an estimated 316,000 affected entities and roughly 210,000 reports over the rule's ten-year analysis period, at an estimated cost near $2.6 billion. As of this writing, CISA's own topic page, retrieved 16 September 2026, states the agency is still reviewing comments and working toward a final rule; the reporting deadlines are not yet mandatory.

Confidence and limits

The enactment date and statutory deadlines are established by the public law text and the legislative record. The rule's cost and volume estimates are CISA's own projections in a proposed, not final, rule, and are properly read as the agency's modeling rather than a measured outcome. This article does not predict when a final rule will publish or what it will ultimately require, since CISA had not finalized it as of the date this was prepared.

Why it mattered

CIRCIA was written to close a specific gap Congress identified: no single federal agency had visibility into cyberattacks against critical infrastructure across sectors, because the dozens of existing reporting rules were scattered across regulators with different deadlines, definitions and recipients. Whatever the final rule requires, the act's structure, a statute that creates duties contingent on a not-yet-final regulation, means the practical question for any organization is not whether CIRCIA applies in principle but whether, and on what date, the specific rule defining covered entities takes effect.

Defensive takeaway

Do not assume CIRCIA's 72-hour and 24-hour deadlines apply to your organization today; instead, track the final rule's publication date and, once it exists, confirm your incident response plan's reporting timeline against the definitions it uses for covered entity and covered incident.

• Would your organization be classified as a covered entity under the definitions CISA has proposed for your sector?
• Does your incident response plan already assume reporting timelines faster than what any current regulation requires of you?
• Who owns tracking the CIRCIA rulemaking's status so the deadline is not missed when it becomes final?

An enacted statute and an effective regulation are not the same thing, and the gap between them, now measured in years rather than months, is itself the most important fact for a defender trying to plan around this law.