The Cybersecurity and Infrastructure Security Agency has sent its final rule under the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) to the White House. Reginfo.gov shows that the Office of Information and Regulatory Affairs (OIRA), part of the Office of Management and Budget, received the rule on October 1, 2026. The rulemaking is listed under RIN 1670-AA04, titled "Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) Reporting Requirements." Its stage is "Final Rule," its legal deadline is marked "Statutory," and its status is "Pending EO 12866 Regulatory Review."

Covington & Burling's Inside Privacy blog calls OIRA review one of the final steps before a rule is published in the Federal Register. The rule is not yet in force, and the final text has not been released. Until it is published, the clearest guide to what the rule requires is the notice of proposed rulemaking (NPRM) that CISA published on April 4, 2024. That proposal opened a 60-day comment period ending June 3, 2024, and on May 6, 2024, CISA extended it by 30 days to July 3, 2024. HIPAA Journal reports that industry groups sought the extension because of the rule's length and complexity.

What the proposal would require

Under the NPRM, as HIPAA Journal summarizes it, covered entities would report cyber incidents to CISA within 72 hours of determining that a substantial incident has occurred, and would report ransom payments within 24 hours of making them.

CIRCIA spans 16 critical-infrastructure sectors, and CISA estimates that about 316,000 entities would need to comply, according to HIPAA Journal. Coverage thresholds are generally based on company size and annual revenue and vary by sector. In healthcare and public health, the NPRM would cover:

  • hospitals with 100 or more beds
  • all critical access hospitals, regardless of size
  • healthcare and public health entities that exceed Small Business Administration size standards
  • manufacturers of regulated drugs and medical devices

HIPAA Journal also notes that these obligations would sit on top of existing HIPAA reporting requirements rather than replacing them. A hospital with a qualifying incident could therefore have reporting duties under both regimes.

A timeline that kept slipping

The proposed rule drew "hundreds of comments," according to Covington, with feedback centered on the rule's scope, its reporting requirements and its overlap with existing reporting obligations. CISA held a series of town halls in June 2026 to gather more stakeholder input.

HIPAA Journal reports that the target date for the final rule moved repeatedly: an initial October 2025 release, then May 2026, then September 2026. CISA sent the rule to OIRA on October 1.

The two sources differ on when the rule will appear. HIPAA Journal writes that "a final rule is expected to be published before the end of the year." Covington writes that "the review by OIRA can take up to 90 days" and that, if OIRA extends its review beyond that, publication would slip to early next year. Ninety days from the October 1 submission is December 30, 2026. As of October 19, the rule has been under review for 18 days.

CIRCIA itself does not set an effective date. Covington expects the regulations to take effect no sooner than 60 days after Federal Register publication, with the exact date to be stated in the final text.

What could still change

The version under review is a final rule, but its text is not public, and Covington does not describe any specific changes from the 2024 proposal. Until then, the NPRM thresholds and covered-entity criteria described above are the proposal, not the final requirements.

What It Means for Defenders

  • Check whether you are likely to be covered. Compare your organization with the NPRM's sector and size criteria (healthcare criteria are listed above). Record the result and the reasoning, so you can update it quickly once the final text is out.
  • Build the two reporting clocks into incident response. Add a CISA reporting decision point to your playbooks. Name who decides whether an incident is "substantial" and who submits the report. Set up a separate, faster path for ransom payments that includes legal and finance.
  • Map CIRCIA reporting alongside existing duties. Healthcare entities should line up CIRCIA reports with HIPAA breach notifications, so one incident triggers every required filing and none is missed. Keep evidence collection consistent so the facts in each filing match.
  • Run a tabletop exercise against the proposed deadlines. Time how long your team takes, from detecting an incident, to decide that it is reportable. If that already uses up most of the proposed window, fix escalation paths now.
  • Watch for publication. Track RIN 1670-AA04 on Reginfo.gov and in the Federal Register. When the final text appears, compare its thresholds and clocks with the NPRM before you finalize procedures.

Sources