US: Delays to cyber incident reporting rules

Why should I read this?

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) will introduce mandatory US federal reporting of serious cyber incidents and ransomware payments affecting critical infrastructure. “Covered entities” operate in one of 16 US critical infrastructure sectors and meet sector‑specific criteria. They will have 72 hours to report cyber incidents and 24 hours to report ransomware payments to the Cybersecurity and Infrastructure Security Agency (CISA). This marks a shift from voluntary engagement to a formal enforcement regime with potential civil penalties.

Although the final rules are not yet in force, CISA has already made clear its expectations. If businesses delay preparation until the effective date, they may struggle to meet the short reporting deadlines and/or preserve the right data during a cyber incident.

What’s happening with the rulemaking?

CISA originally planned to finalize the CIRCIA rules around mid-2026. Early 2026 was meant to be a practical trial phase. CISA planned to use town hall meetings between March and April to, among other things, test how the rules would operate in practice and hear feedback on points such as definitions and reporting thresholds. 

But on March 25, 2026, CISA announced that funding constraints and staff shortages had led to the cancellation of the town halls and other activity. As a result, work needed to finalize the rules has been paused. CISA has indicated that new dates will be published once operations resume, but the delays make it more likely that the final rules (and the point when reporting becomes mandatory) will be delayed beyond mid-2026. 

Alongside this, industry feedback to the 2024 Notice of Proposed Rulemaking suggests considerable further work may be needed. Many stakeholders argued that the scope was too broad, certain definitions were unclear and reporting timelines were too rigid. There were also concerns around too many overlapping rules that could affect businesses’ ability to fix incidents. 

How does this fit into the wider policy picture?

While the CIRCIA rules are being delayed, the US administration’s broader cyber strategy is still moving forward. Its March 2026 cyber strategy makes clear that one of its priorities is to protect critical infrastructure by focusing on genuinely serious cyber incidents (those that pose real risks to national security or essential services) and by enabling such infrastructure to recover quickly when incidents happen. 

The tension lies in the gap between what the government wants to achieve and how the proposed rules may work in practice. The aim is to strengthen national cyber resilience, but businesses are worried about the uncertainty around what they need to do and when.

What can businesses do now?

The key message is not to wait for perfect clarity. Threat levels remain high and regulatory expectations continue to build. But don’t let delays in rulemaking affect (or slow down) organizational responsibility. Preparing now puts businesses in a strong position, even though the final rules are still uncertain. Good preparation reduces both cyber risk and regulatory risk, whatever the final outcome.

Key actions include the following:

• Check whether you’re likely to fall within CIRCIA’s scope, based on your sector and the proposed criteria.
• Check whether current systems and procedures would allow you to identify an incident, escalate it internally and decide whether to report it within 72 hours.
• Make sure incident response plans are updated to ensure relevant evidence and records can be preserved for the required period.
• Clarify who makes reporting decisions and how those decisions are recorded.
• Pay attention to cyber incidents affecting third parties and suppliers, and be clear about who is responsible for reporting when those incidents impact their own operations.
• Plan for more responsibility with less external support in the short term. Reporting remains voluntary for now, but CISA continues to encourage entities to report incidents to familiarize themselves with the process.

Further reading

• The Cyber Incident Reporting for Critical Infrastructure Act of 2022

__________

If you have any questions about this Legal Briefing, please feel free to contact any of the attorneys listed or the Eversheds Sutherland attorney with whom you regularly work.