IC Oversight & Authorities — 2026-06-13

CISA Revives Push Toward Long-Awaited Cyber Incident Reporting Rules Under CIRCIA

BLUFCIRCIA finalization by year-end 2026 is very unlikely, as unresolved scope conflicts and bipartisan skepticism leave the rule in administrative limbo with no credible path to resolution.

CISA this week hosted virtual town halls on draft CIRCIA regulations that would require 72-hour cyber incident reporting and 24-hour ransomware payment notifications across 16 critical infrastructure sectors, per Federal News Network and a May 26 Federal Register notice 12. Acting Director Nick Andersen, speaking at a June 9 conference, declined to set a finalization date pending review of stakeholder feedback 1. The 2024 draft drew criticism for covering an estimated 300,000 entities and conflicting with existing sector-specific regulations; House Homeland Security Chairman Andrew Garbarino called the rules "not good" at a June 10 forum 1. The House Appropriations Committee urged CISA to finalize promptly in its fiscal 2027 homeland security spending report 1.

Analysis
CISA is very unlikely to publish a final CIRCIA rule by year-end 2026: Acting Director Andersen explicitly refused to commit to a finalization date, and the draft's estimated 300,000-entity coverage and conflicts with existing sector-specific regulations represent structural problems town halls cannot resolve. Moderate confidence reflects the visible alignment between Andersen's public posture, Garbarino's public opposition, and the absence of any announced scope-reduction framework. Congressional Appropriations pressure is real but insufficient to override the administrative complexity of reconciling conflicting sector regulations. With the Federal Register notice as the sole primary source and Federal News Network providing secondary synthesis, independent visibility into CISA's deliberative posture is limited. A narrowed scope satisfying Garbarino's objections could reopen a 2026 path, but absent that reduction, covered entities across all 16 sectors should treat compliance investment as deferrable until the next rulemaking cycle.

2 sources

CISA revives push toward long-awaited cyber incident reporting rules - Federal News Network
Town Hall Meetings To Provide Input on Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Rulemaking - Federal Register