CIRCIA cyber incident reporting rule enters final White House review

The U.S. Cybersecurity and Infrastructure Security Agency sent its final rule under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 — known as CIRCIA — to the White House Office of Information and Regulatory Affairs on October 1, 2026, beginning the last major review step before the rule can be published in the Federal Register.

When published, CIRCIA will require covered organizations across 16 critical infrastructure sectors to report significant cyber incidents to CISA within 72 hours and ransomware payments within 24 hours. CISA estimates that roughly 316,000 entities would fall under the rule, spanning healthcare, energy, financial services, transportation, communications, water systems, and information technology, among others. The agency put the total compliance cost at approximately $2.6 billion over eleven years, primarily for building out reporting processes. The rule is more than a year past its original statutory deadline; CISA had previously pushed the target date from October 2025 to May 2026, then to September, before submitting in October.

The White House review is procedural — no compliance clock starts running and the final text can still change before publication. Industry groups had argued the 2024 proposal was too broad and overlapped with existing reporting requirements from the SEC, the FCC, and sector regulators. CISA indicated in 2025 it would narrow the scope, but the final language will not be known until review concludes. A final rule is expected before the end of 2026.

Organizations in any of the 16 covered sectors — including hospitals, utilities, and technology providers — may want to review their current incident response and ransom payment documentation processes now, so they are not building reporting workflows from scratch when a compliance date is eventually set. Legal and compliance teams should also monitor whether the published rule changes which subsidiaries or vendors within a corporate family are individually covered.