policy · 1647302400000

Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Enacted

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) was signed into law, requiring covered critical infrastructure entities to report cyber incidents and ransomware payments to CISA.

What happened

President Biden signed CIRCIA into law in March 2022. The act mandates that covered entities report significant cyber incidents to CISA within 72 hours and ransomware payments within 24 hours. It directed CISA to undertake a rulemaking process to define the specific regulations, covered entities, and incident thresholds.

Technical mechanism

Policy mechanism requiring rapid disclosure to a central federal agency (CISA) to enable trend analysis and rapid warning distribution.

Why it matters

Marks a major shift in US cybersecurity policy from voluntary sharing to mandatory reporting for critical infrastructure, aiming to improve national visibility into cyber threats.

Impact

Fundamental change in compliance and incident response procedures for thousands of critical infrastructure operators in the US.

Response

CISA began a multi-year rulemaking process, including publishing a Notice of Proposed Rulemaking (NPRM) and holding town halls to gather industry feedback.

Defensive lessons

  • Organizations must integrate regulatory reporting timelines into their incident response plans.
  • Requires mature monitoring and rapid assessment capabilities to meet the 72-hour reporting window.

Evidence register

  1. CISA — Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) (verified)