CISA Launches CIRCIA Town Halls: Mandatory Cyber Incident Reporting Rules Expected May 2026

CISA began sector-specific virtual town halls to gather input on CIRCIA rules requiring critical infrastructure companies to report cyberattacks within 72 hours and ransom payments within 24 hours. The final rule is expected May 2026. The regulation will create the first mandatory federal cyber incident reporting framework, fundamentally changing the visibility the government has into attacks on critical infrastructure.