The Cybersecurity and Infrastructure Security Agency (CISA) sent its final CIRCIA rule to the Office of Management and Budget (OMB) for review on October 2, 2026. This milestone marks a practical challenge for thousands of organizations: how to file duplicate incident reports to separate federal agencies under different timelines, formats, and retention requirements without doubling your compliance workload.
What Happened
CISA's final rule under the Cyber Incident Reporting for Critical Infrastructure Act requires organizations in 16 critical infrastructure sectors to report substantial cyber incidents within 72 hours and ransom payments within 24 hours. The rule was originally due in October 2025 but faced delays after stakeholders raised concerns about overlap with existing federal mandates.
The proposal impacts nearly 300,000 organizations nationwide, many of which already report to other federal agencies under separate rules. For example, defense contractors must report incidents involving controlled unclassified information to the Pentagon within 72 hours under the Defense Federal Acquisition Regulation Supplement (DFARS). CISA's 2024 proposal acknowledged this overlap but offered only conditional relief: organizations could satisfy CIRCIA with an existing report filed to another agency, but only if CISA and that agency negotiate a formal agreement.
No such agreement exists with the Department of Defense, and there is no indication one is forthcoming.
Timeline
- March 2022: Congress passes CIRCIA, directing CISA to create mandatory incident reporting rules.
- October 2025: Statutory deadline for final rule passes; CISA delays to May 2026.
- May 2026: Acting Director Nick Andersen commits to implementing the rule "with minimal unnecessary burden."
- June 2026: Stakeholder town halls resume after funding lapse.
- July 2026: Government Accountability Office finds that 70% of 117 federal cybersecurity regulations carry the same reporting requirement as at least one other rule.
- October 2, 2026: CISA submits final rule to OMB for review.
Regulatory Design Failures
This isn't about a breach; it's about regulatory design failure. The missing control is inter-agency coordination before rule publication. CISA wrote a rule that creates redundant reporting burdens, then made relief conditional on agreements it hasn't negotiated.
Key failures include:
No pre-coordination with existing regulators: CISA didn't secure agreements with the Pentagon, SEC, banking regulators, or other agencies that already collect incident reports before finalizing its rule. Organizations subject to both CIRCIA and DFARS will now file two reports for the same incident.
Mismatched reporting thresholds: DFARS applies only to incidents involving controlled unclassified information. CIRCIA defines "substantial" incidents more broadly. A contractor experiencing a ransomware attack that doesn't touch CUI still files to CISA, but the Pentagon report doesn't satisfy CIRCIA because the scope differs.
Different retention periods: CIRCIA requires two years of incident data retention. DFARS requires 90 days. Your compliance team now maintains two separate retention schedules for the same event.
Incompatible follow-up requirements: CIRCIA demands supplemental reports as new details emerge. DFARS has its own update cadence. You're not filing once and moving on; you're managing parallel reporting workflows with different triggers.
Relevant Standards and Requirements
There's no single standard governing inter-agency regulatory harmonization, but several frameworks establish the principle that overlapping mandates should be consolidated wherever possible.
OMB Circular A-123: Requires federal agencies to coordinate internal controls and avoid duplicative requirements across government programs. While it doesn't explicitly cover cybersecurity reporting, the principle applies: federal agencies shouldn't impose redundant burdens on regulated entities without demonstrating unique value.
Administrative Procedure Act (5 U.S.C. § 553): Requires agencies to consider public comments during rulemaking. The Congressional Research Service noted that commenters raised the harmonization issue extensively. CISA acknowledged the concern but didn't resolve it before submitting the final rule.
GAO's July 2026 report: Found that harmonization efforts across federal cybersecurity regulations have made "limited progress." The report doesn't impose requirements, but it establishes a baseline: 70% overlap is a systemic problem, not an edge case.
Action Items for Your Team
Map your current reporting obligations now: List every federal, state, and sector-specific incident reporting requirement your organization faces. Include timelines, thresholds, scope, and retention periods. Defense contractors should compare DFARS 252.204-7012 with CIRCIA's substantial incident definition to identify gaps where one report won't satisfy both.
Build a unified incident intake process: Your security operations center shouldn't determine which regulator gets notified based on the incident type. Create a single intake workflow that captures all data points required by any reporting rule you face. Route that intake record to multiple agencies as needed, rather than drafting separate reports from scratch.
Advocate for formal inter-agency agreements: If you're subject to both CIRCIA and another federal reporting rule, submit comments during OMB's review period (if still open) or directly to CISA afterward. The agency acknowledged that agreements with other regulators would reduce burden but hasn't negotiated them. Your compliance team can't fix this alone, but your industry association can pressure CISA to finalize those agreements before enforcement begins.
Prepare for dual reporting: Assume you'll file twice until CISA publishes a formal agreement. Budget compliance time accordingly.
Challenge the "minimal unnecessary burden" claim: CISA's May 2026 statement committed to minimizing burden, but the rule as submitted creates explicit duplication. If your organization faces material compliance costs from overlapping reporting, document those costs and share them with your congressional delegation. Regulatory agencies respond to demonstrated burden, not hypothetical complaints.
The final rule isn't published yet. OMB review typically takes 60 to 90 days, which means implementation could begin in early 2027. You have time to prepare, but not much. Start mapping your obligations now, because CISA isn't going to harmonize them for you.
