Jujubes lemon drops tart lollipop brownie
Cupcake Ipsum, 2015
The law directs CISA to build a mandatory reporting system with two core obligations for "covered entities":
This is different from the breach notification laws many businesses already know. State breach laws and rules like HIPAA or the SEC's Item 1.05 disclosure requirement are about notifying consumers, patients, or investors. CIRCIA is about giving the federal government — specifically CISA — fast, structured, technical visibility into attacks so it can spot patterns, warn other potential victims, and coordinate a national response. It doesn't replace your existing notification obligations; it stacks on top of them.
Here's the part that's actually news: CIRCIA has been law since 2022, but it has never been enforceable, because CISA still hasn't finished writing the regulations that implement it. CISA missed its original October 2025 statutory deadline to finalize those rules, missed a revised May 2026 target after a government funding lapse delayed public town halls, and is now aiming for September 2026 — which is essentially right now. That single fact is why this topic deserves your attention this month, not next year.
It also helps to understand why Congress felt this law was necessary in the first place. Before CIRCIA, cyber incident reporting to the federal government was almost entirely voluntary and fragmented across dozens of sector-specific rules, informal FBI notifications, and inconsistent state laws. When the 2021 Colonial Pipeline ransomware attack shut down fuel delivery across the East Coast, investigators and policymakers realized the government often learned about attacks on the systems Americans rely on from news coverage — not from the companies involved. CIRCIA was designed to close that gap by making reporting mandatory, standardized, and fast enough that CISA can actually warn other likely targets before an attack spreads sector-wide.
Who Is Affected by CIRCIA?
CIRCIA uses what's often called a two-track coverage test. Your organization is a "covered entity" if it meets either of the following:
Those 16 sectors, as defined by CISA, are: Chemical, Commercial Facilities, Communications, Critical Manufacturing, Dams, Defense Industrial Base, Emergency Services, Energy, Financial Services, Food and Agriculture, Government Facilities, Healthcare and Public Health, Information Technology, Nuclear Reactors/Materials/Waste, Transportation Systems, and Water and Wastewater Systems.
CISA's own regulatory analysis estimates roughly 316,000 entities will fall within scope — and notably, the agency classifies over 310,000 of those as small entities. In other words, CIRCIA is not just a Fortune 500 problem. A 40-person water utility or a small community hospital can be squarely covered under Track 2, even though it would never trigger Track 1's size thresholds.
One detail worth flagging: the reporting trigger is what you reasonably believe happened, not what you've conclusively proven through a completed forensic investigation. That standard was one of the most debated topics at CISA's 2026 town halls — industry groups pushed for a clearer, higher bar so routine security alerts and false positives don't flood CISA with reports, while CISA has signaled it wants the trigger to stay early enough that the agency isn't the last to know. Expect the final rule's exact language here to matter a great deal in practice.
A Note for IT-Dependent Businesses and Their Vendors
Coverage isn't limited to the household-name sectors. The Information Technology sector is explicitly on CISA's list, which means many managed service providers, cloud hosting companies, and software vendors could be directly covered once the size or sector thresholds are met. And even businesses that aren't covered entities themselves can be pulled into the reporting chain indirectly: CIRCIA's definition of a reportable incident includes supply chain compromises, so if an attack on a vendor, contractor, or cloud provider disrupts a covered entity's operations, that downstream impact can itself trigger a 72-hour clock for the affected business. During its 2026 town halls, CISA specifically flagged "treatment of cloud and managed service providers" as one of the most contested open questions in the rule — a strong signal that vendor and supply-chain obligations will get real scrutiny in the final text.
Practically, that means every covered business should expect to start asking its own vendors andIT partners a new question: "How fast will you tell us if you're breached, and what will you give us to file our own CIRCIA report on time?"
How CIRCIA Will Affect Your Business
For most organizations, CIRCIA's biggest impact won't be the reporting form itself — it will be everything upstream of it. Meeting a 72-hour deadline that starts the moment you reasonably believe an incident occurred (not the moment you've fully confirmed it) requires a very different level of readiness than the informal, ad hoc incident response many small and mid-sized businesses rely on today.
What has to be in a report
A CIRCIA report generally needs to describe the systems and networks affected, a timeline of the incident, the tactics and techniques the attacker used, the impact on operations, and any mitigation steps already taken. If new facts emerge afterward, supplemental reports are expected, and CISA is expected to require records be retained for a period of time after the incident. That's a meaningfully more technical and structured submission than a typical breach-notification letter.
It layers on top of what you already do
CIRCIA doesn't replace HIPAA breach notification, GLBA safeguards reporting, the SEC's 8-K Item 1.05 cyber disclosure rule, or state breach notification statutes — it adds a parallel federal reporting track alongside them. CISA has acknowledged the overlap is a real burden and is exploring a "substantially similar reporting" exception that would let a report already filed with another federal regulator satisfy CIRCIA in some cases, but that mechanism is still being worked out in the rulemaking. Until it's finalized, businesses should plan to treat CIRCIA as an additional obligation, not a replacement for existing ones.
How CIRCIA compares to rules you may already followMost covered entities won't be starting from zero — many already report incidents somewhere. The table below shows how CIRCIA fits alongside a few of the reporting obligations businesses commonly juggle already:
| Rule | Who you notify | Typical deadline |
| CIRCIA | CISA (federal) | 72 hrs (incident) / 24 hrs (ransom payment)* |
| HIPAA Breach Notification | HHS, affected patients | 60 days |
| SEC Item 1.05 (8-K) | Investors, via SEC filing | 4 business days after materiality determination |
| State breach notification laws | Affected residents, state AG | Varies — often 30–60 days |
| GLBA Safeguards Rule | FTC (financial institutions) | As soon as possible, generally within 30 days |
*CIRCIA's deadlines are the fastest of the group by a wide margin — a large part of why incident response speed, not just legal review, becomes the bottleneck.
There are real teeth behind it
CIRCIA gives CISA meaningful enforcement tools for non-compliance. If an entity doesn't report as required, CISA can issue a Request for Information with its own 72-hour response window; ignoring that can escalate to a subpoena, and a continued refusal can be referred to the Department of Justice. Knowingly false statements in a report can carry criminal penalties of up to five years in prison (eight if tied to terrorism), and federal contractors face suspension and debarment risk on top of that. On the other hand, the law also includes real protections for businesses that report in good faith: reports generally can't be used against the submitter in most civil litigation, aren't subject to Freedom of Information Act requests, and don't waive attorney-client privilege or other legal protections.
When Does CIRCIA Actually Go Into Effect?
This is the question everyone asks, and the honest answer is: soon, but not instantly. Here's the timeline so far:
Here's the nuance that matters most for planning purposes: publishing the final rule is not the same as reporting becoming mandatory that day. The final rule itself will specify its own effective date, and based on how similar federal rules have phased in, most legal and industry analysts expect enforceable reporting obligations to begin sometime between late 2026 and 2027 — likely with a compliance runway of several months after publication. Until that effective date arrives, reporting cyber incidents to CISA under CIRCIA remains voluntary (though CISA continues to encourage it), and none of your other reporting obligations change in the meantime.
It's also worth staying skeptical of any single date, given CIRCIA's track record: this rule has already missed one statutory deadline and one internal target. Treat September 2026 as CISA's current best estimate, not a guarantee — and treat the runway between now and whenever the rule lands as valuable preparation time, not a reason to wait.
How to Prepare Now
Because the exact effective date is still moving, the smartest move for most businesses is to prepare for CIRCIA's substance now rather than waiting for a final date to appear in the Federal Register. A few concrete steps:
If any of this feels like more than your internal team can take on alone, that's exactly the gap a managed IT and security partner is built to close. LBT Technology Group, LLC. helps businesses assess their CIRCIA exposure, harden detection and monitoring, and build incident response plans that can actually hit a 72-hour deadline under pressure. Reach out to our team for a CIRCIA readiness conversation before the final rule not during your first incident under it.
CIRCIA has spent four years as a law without teeth, but that's about to change. With CISA targeting a September 2026 final rule after a long string of delays, the businesses that come out ahead will be the ones that treat the next few months as a planning window rather than a waiting period. Understand whether you're covered, know your 72- and 24-hour obligations, and get your incident response plan ready to move at regulatory speed; because once the final rule publishes, the runway to comply will be shorter than the runway it took to write it.
No. CIRCIA is law, but its reporting requirements only become mandatory once CISA's final rule is published and its effective date arrives, expected sometime after the targeted September 2026 publication. Until then, reporting cyber incidents to CISA under CIRCIA is voluntary, though CISA encourages it and other existing obligations (HIPAA, SEC, state laws) still apply as normal.
It can. If your business falls within one of the 16 critical infrastructure sectors, you can be covered under the sector-based track regardless of size. Size-based coverage (Track 1) only applies outside that automatic sector coverage, using SBA thresholds that vary by industry.
Generally, an incident that leads to a substantial loss of confidentiality, integrity, or availability of a covered entity's systems, a serious impact on operations, or unauthorized access facilitated through a third party such as a cloud provider or managed service provider. The final rule will define the exact threshold for "substantial."
CISA can request information with its own short deadline; continued non-response can lead to a subpoena and potential referral to the Department of Justice. Knowingly false statements carry criminal penalties, and federal contractors risk suspension or debarment.
Not automatically. CIRCIA adds a federal reporting requirement alongside HIPAA, GLBA, SEC, and state breach laws. CISA is developing a "substantially similar reporting" exception to reduce duplicate filings, but until that's finalized, plan to meet each obligation separately.
Necessary cookies support essential features such as secure sessions and forms. Analytics is optional and stays off unless you allow it.
Required for core site functions, security, and preferences.
