CISA submitted its final Cyber Incident Reporting for Critical Infrastructure Act rule to the White House Office of Management and Budget on October 2, 2026. The rule mandates that critical infrastructure operators across 16 sectors report significant cyber incidents within 72 hours and ransom payments within 24 hours. Nearly 300,000 organizations will be affected when it takes effect.
For defense contractors, this creates a second reporting requirement alongside existing Department of Defense mandates.
Timeline
March 2022: Congress passes CIRCIA, setting an October 2025 deadline for final rule implementation.
2024: CISA publishes a proposed rule requiring 72-hour incident reporting and 24-hour ransom payment disclosure.
May 2025: CISA delays implementation to May 2026 due to concerns about scope and regulatory overlap.
June 2025: Department of Homeland Security funding lapse delays stakeholder town halls until June.
July 2025: Government Accountability Office finds 70% of 117 federal cybersecurity regulations contain overlapping reporting requirements, with limited harmonization progress.
October 2, 2026: CISA submits final rule to OMB for review.
Which Controls Failed or Were Missing
The issue isn't a breach, but a failure in regulatory architecture. Harmonization is the missing control. About 70% of federal cybersecurity regulations have overlapping reporting requirements, according to the GAO. Defense contractors already report cyber incidents to the Pentagon within 72 hours under DFARS. Financial institutions report to their regulators, and healthcare entities report to HHS under HIPAA.
CISA's proposed solution allows organizations to satisfy CIRCIA by filing a similar report to another federal agency, but only if CISA and that agency have a formal agreement. No such agreement exists with the Department of Defense, meaning CIRCIA will likely create a secondary reporting requirement for defense contractors.
The gap is jurisdictional and structural. Different regulators collect incident data for different purposes. Defense reporting focuses on incidents involving controlled unclassified information, while CIRCIA covers broader cyber incidents affecting critical infrastructure. The Congressional Research Service concluded it's unlikely other regulators would drop their own requirements because the rules serve distinct purposes.
CIRCIA also requires follow-up reports as new details emerge and two years of incident data retention, compared to 90 days under DFARS. These differences are significant and represent fundamentally different compliance structures.
What the Relevant Standard Requires
CIRCIA establishes a new federal reporting obligation. It requires covered entities to report significant cyber incidents within 72 hours and ransom payments within 24 hours. "Significant" remains undefined, though CISA's 2024 proposal indicated it would include incidents materially disrupting operations or compromising sensitive data.
For defense contractors, the existing baseline is DFARS 252.204-7012, which requires reporting cyber incidents affecting covered defense information within 72 hours. The Cybersecurity Maturity Model Certification program was suspended in July 2025 due to its burden on smaller suppliers.
SR 23-4, the interagency guidance on third-party relationship risk management, doesn't mandate specific incident reporting timelines but requires financial institutions to maintain notification procedures for material incidents involving critical third parties. The EBA Outsourcing Guidelines require institutions to ensure material outsourcing arrangements include incident notification clauses, typically within 24 hours for critical incidents.
None of these frameworks solve the core problem: organizations operating across multiple critical infrastructure sectors face fragmented, overlapping reporting obligations with no unified intake mechanism.
Lessons and Action Items for Your Team
Map your current reporting obligations by sector and regulator. If you're a defense contractor with healthcare contracts or financial services clients, you may already be reporting the same incident in multiple ways. Document the trigger thresholds, timelines, and required data fields for each obligation. This isn't just compliance documentation; it's your baseline for measuring CIRCIA's incremental burden.
Don't wait for harmonization agreements. CISA's proposal allows substitution only if formal inter-agency agreements exist. There's no indication such an agreement will be reached with the Department of Defense. Plan for dual reporting. Build your incident response playbook to accommodate both DFARS and CIRCIA timelines, even if the incident facts overlap.
Extend your data retention architecture. CIRCIA requires two years of incident data retention versus 90 days under DFARS. If your current logging and SIEM retention policies are set to defense requirements, you'll need to extend storage and ensure forensic data remains accessible for follow-up reporting as new details emerge.
Audit your definition of "substantial." CISA hasn't published the final threshold, but the 2024 proposal suggested incidents materially disrupting operations or compromising sensitive data would qualify. Review your incident classification framework. If you're currently triaging incidents as "reportable to DoD" versus "not reportable," add a third category: "potentially reportable under CIRCIA." Train your SOC and incident response teams to flag incidents that meet either threshold.
Pressure test your 24-hour ransom payment reporting workflow. This is the tightest timeline in the rule. If your organization prohibits ransom payments, document it and ensure your incident response plan reflects that stance. If you're leaving the decision to executive discretion during an active incident, build a notification workflow that can reach CISA within 24 hours of payment authorization. That means pre-drafted templates, designated points of contact, and a clear escalation path.
Engage your legal and compliance teams now. The rule is under OMB review and expected before year-end. You won't have months to build new processes once it's published. Start drafting your CIRCIA notification procedures, identify gaps in your current incident response plan, and allocate budget for extended data retention infrastructure.
Harmonization was supposed to reduce burden. Instead, it's becoming a compliance layer of its own.
