CIRCIA reporting rule

The CIRCIA reporting rule is the specific regulation CISA must finalize to put the act’s reporting requirements into force, defining exactly which entities and incidents are "covered" and how reports must be submitted. As of September 2026, the rule has faced repeated delays since the act passed in 2022 (an earlier draft was criticized as overly broad about what counts as a reportable incident), and per the 2026 Unified Agenda, CISA has targeted finalizing it this same month. This status may change at any time; check the Federal Register for the current position.