United States. Cybersecurity. Act

CIRCIACyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)

Enacted – not yet in force

Partly verified

Medium confidence. Could not confirm whether the final rule was published in Sept/Oct 2026; check the Federal Register.

§1Summary

Synopsis

Will require covered entities in critical infrastructure sectors to report substantial cyber incidents to CISA and to report ransomware payments. Detailed scope and content are set by CISA rulemaking.

Key themes

critical infrastructure
incident reporting
ransomware payments
data preservation

Unique features

Reports go to a security agency, not a privacy regulator; reports are shielded from use in regulatory enforcement in many cases.

SaaS relevance

SaaS providers to critical infrastructure, or IT/cloud providers meeting sector criteria, may become covered entities once the rule is final.

§2Obligations

Breach notification: Proposed: CISA within 72 hours of reasonable belief of covered incident; ransom payments within 24 hours
DPO: No
Cross-border transfers: None
Maximum penalty: Subpoena and civil action to compel reporting; contempt

§3Dates

Key dates

Adopted 15 March 2022
NPRM published 2024-04-04; statutory final-rule deadline (Oct 2025) missed; CISA targeted May 2026, then September 2026 for the final rule; reporting duties start only once the final rule takes effect.

§4Text and authority

Text

Authoritative text cisa.gov

Authority

Cybersecurity and Infrastructure Security Agency (CISA)

§6Sources and verification

Verification

Medium confidence.