The final rule implementing the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) has moved from CISA to the White House for review. It is a procedural step, not a go-live date. For executives, it changes the planning question from “will this happen?” to “are we ready when the date is announced?”
Where the Rule Stands
According to a Paubox summary dated 14 October 2026 and a Covington analysis on Inside Privacy dated 8 October 2026, CISA submitted the draft final rule to the Office of Information and Regulatory Affairs (OIRA) on 1 October 2026. Paubox reports that OIRA logged it under regulation identifier 1670-AA04.
The path to this point has been slow. Congress passed the law in March 2022 with a statutory deadline of October 2025 for the final rule. Paubox reports that CISA then missed internal targets of May 2026 and September 2026. Hunton reported in July 2026 that rescheduled stakeholder town halls ran from 15 to 18 June 2026 and drew more than 1,200 attendees.
Covington notes that OIRA review can take up to 90 days, or longer if extended, which could push publication into early 2027. Covington also expects the rule to take effect at least 60 days after Federal Register publication. CIRCIA itself sets no effective date, so that expectation is commentary, not a fixed requirement.
The sources we reviewed, the latest dated 14 October 2026, all describe the rule as under review and unpublished. We could not open the OIRA record on reginfo.gov, so we have not confirmed the status directly.
What the 2024 Proposal Would Require
The final text may differ from the April 2024 proposal. Paubox reports that the proposal, if carried through, would involve:
- Reporting a substantial cyber incident to CISA within 72 hours of reasonably believing one has occurred, with follow-up reports as facts emerge.
- Reporting ransomware payments within 24 hours.
- Coverage across the 16 critical infrastructure sectors, above small business size thresholds, with CISA estimating more than 300,000 affected businesses.
- Retaining relevant records for two years.
Paubox also reports that more than 1,000 public comments criticised the breadth of the scope, unclear definitions and overlap with existing reporting rules. Those are the areas most likely to change, and the areas where your planning is most exposed to surprise.
What This Means for the Board
Our assessment: waiting for the Federal Register notice is a poor use of the review window. Most of the preparation is governance work that takes longer than the legal clock. Three decisions are worth taking now.
1. Confirm whether you are in scope, and record why. Sector and size criteria may shift, so document a provisional assessment against the 2024 proposal and a date to revisit it when the final text appears. Include subsidiaries and acquired entities, which are often missed.
2. Assign decision rights for the “reasonable belief” trigger. A 72-hour clock that starts on a reasonable belief puts pressure on whoever decides that threshold has been met. Name the individual or committee, their deputies, and the escalation route to the general counsel and the board chair. Rehearse it in the next tabletop exercise.
3. Map overlapping obligations to a single intake process. Many organisations already answer to the SEC, sector regulators, or state breach laws. Paubox cites a GAO finding that about 70% of 117 federal cybersecurity regulations reviewed contained redundant reporting requirements. Our assessment is that one incident record feeding several regulatory notices is cheaper and less error-prone than parallel workstreams. Our earlier briefing on overlapping cyber regulation covers this in more detail.
Questions to Put to Management
- Which of our entities and business lines would a covered-entity test capture, and who owns that determination?
- Can we produce a reliable incident timeline within 72 hours, including supplier and cloud logs?
- Do our log retention periods meet a two-year record requirement if it survives into the final text?
- Who has authority to approve a ransomware payment, and does that process trigger the 24-hour report automatically?
- Do our service provider contracts oblige suppliers to notify us fast enough for us to meet our own deadline?
Point of Caution
Reporting under CIRCIA is not yet mandatory. Sources we reviewed state that applicability dates would be set after the final text is published. Spending on tooling before the scope is settled carries the risk of rework, so we favour low-cost governance steps first and capital commitments later.
Sources Reviewed
- Paubox, “Cyber incident reporting rule reaches final White House review” (14 October 2026)
- Covington, Inside Privacy, “CISA Submits Final CIRCIA Rule for OMB Review” (8 October 2026)
- Hunton Andrews Kurth, “CISA plans to finalize cyber incident reporting regulations in September 2026” (17 July 2026)