Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)

A vulnerability and incident reporting rule binding public and private bodies.

What it requires

Where your organization is a covered entity in one of sixteen critical-infrastructure sectors, a status the statute leaves to a final rule to define, the covered cyber incident report, the ransom payment report, the supplemental report, and the data-preservation duty in 6 U.S.C. 681b(a) apply from the dates that final rule prescribes; declare operates_essential_service if your organization is a designated critical-infrastructure operator, since the Agency's April 2024 proposal would define that class by a small-business size threshold or a sector-specific criterion rather than by anything a general software or AI vendor does. The Cybersecurity and Infrastructure Security Agency had not issued that final rule as of September 20, 2026.
Once the final rule takes effect, report a covered cyber incident to the Agency not later than 72 hours after your organization reasonably believes that the covered cyber incident has occurred.NIST CSF 2.0RS.CO-02
Once the final rule takes effect, report a ransom payment to the Agency not later than 24 hours after your organization makes the payment, even where the underlying ransomware attack is not itself a covered cyber incident.NIST CSF 2.0RS.CO-02
Once the final rule takes effect, promptly submit an update to a previously submitted covered cyber incident report whenever substantial new or different information becomes available or a ransom payment is later made, continuing until your organization notifies the Agency that the incident has concluded and been fully mitigated and resolved, and preserve data relevant to the incident or payment under the procedures the final rule establishes.NIST CSF 2.0RS.CO-03 NIST CSF 2.0RS.AN-07
A cloud service provider or managed service provider whose own compromise caused the impact at one of your customers is not, by virtue of that fact alone, a covered entity required to report; the duty runs to the covered entity whose systems were affected, unless the provider independently meets the covered-entity criteria in its own right.

These lines are LexLint's reading of the law's text.

In the frameworks

RS.AN-07Incident data and metadata are collected, and their integrity and provenance are preserved
RS.CO-02Internal and external stakeholders are notified of incidents
RS.CO-03Information is shared with designated internal and external stakeholders

Our reading of where this law's duties sit in each framework, and in the NIST CSF 2.0, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law

What this law does

Drafted with AI

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page. How this site is made

Research summary

Legal information, not legal advice. This is LexLint's own research summary of a public legal source, and it creates no attorney-client relationship. For decisions that matter, consult qualified counsel in the relevant jurisdiction. About LexLint

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 is a federal statute enacted March 15, 2022 that would require a covered entity to report a covered cyber incident and a ransom payment to the Cybersecurity and Infrastructure Security Agency. A covered entity must report a covered cyber incident to the Agency not later than 72 hours after the covered entity reasonably believes the incident has occurred.

A covered entity that makes a ransom payment must report the payment to the Agency not later than 24 hours after the payment is made, even where the underlying attack is not itself a covered cyber incident. A covered entity must also submit a prompt supplemental report whenever substantial new information becomes available or a later ransom payment is made, continuing until the covered entity reports the incident concluded, and must preserve data relevant to the incident or payment.

The statute leaves the definition of covered entity, and the effective date of all four of these duties, to a final rule the Agency must issue. The Agency published a notice of proposed rulemaking on April 4, 2024 at 89 FR 23644, docket CISA-2022-0010, proposing to define covered entity by a small-business size standard or by one of several sector-based criteria across sixteen critical infrastructure sectors.

The statute required the Agency to issue the final rule not later than 18 months after that publication, a deadline of October 4, 2025, and the Agency has not met it. As of September 20, 2026 the Agency has not published a final rule, and its own published status page states that it continues to work on the final rule after multiple lapses in its own funding disrupted the rulemaking.

Until the final rule takes effect none of these four duties binds anyone, and the Agency asks entities only to volunteer cyber incident information in the meantime.

The proposed rule states that a cloud service provider or a managed service provider is not itself obligated to report merely because a compromise of its own systems caused the impact at a customer, since the reporting duty runs to the covered entity whose systems were affected rather than to the vendor, unless that vendor independently meets the covered-entity criteria in its own right.

When LexLint raises it

When your app profile says your app runs an essential service.

Back to the example · Lint your app

Page updated 20 September 2026.