Cybersecurity & Privacy — 2026-03-22
CIRCIA Cyber Incident Reporting Rule Delayed to May 2026; CISA Reopens Comment Period
CISA delayed publication of the CIRCIA final rule to May 2026, extending the comment period with seven virtual town halls between March 9 and April 2. The rule will require critical infrastructure entities across energy, finance, healthcare, transportation, and communications to report substantial cyber incidents within 72 hours and ransom payments within 24 hours. Key definitions around 'substantial cyber incident' and third-party supply chain triggers remain under refinement. Congress separately extended CISA 2015 through September 2026.
Analysis
IC Brief reported CISA postponing CIRCIA town halls due to shutdown. The May 2026 delay compounds the regulatory gap: critical infrastructure incident reporting requirements remain voluntary during the most active Iranian cyber campaign in history.
IC Brief reported CISA postponing CIRCIA town halls due to shutdown. The May 2026 delay compounds the regulatory gap: critical infrastructure incident reporting requirements remain voluntary during the most active Iranian cyber campaign in history.