Cyber Incident Reporting for Critical Infrastructure Act CIRCIA

Before 2022, most private companies that run power plants, pipelines, hospitals, banks, and water systems had no federal duty to report cyberattacks, leaving the government with an incomplete picture of threats. After the ransomware attack that shut down the Colonial Pipeline in May 2021 and caused fuel shortages along the East Coast, Congress passed the Cyber Incident Reporting for Critical Infrastructure Act, signed on March 15, 2022, as part of a spending law.

The law directs the Cybersecurity and Infrastructure Security Agency to write rules requiring covered companies to report substantial cyber incidents within 72 hours and ransom payments within 24 hours. The reports are meant to help the agency spot campaigns across industries and warn others quickly. The law protects reports from being used in most regulatory enforcement and gives companies some liability protection, and the agency can subpoena companies that fail to report.

The agency proposed rules in April 2024 that would cover more than 300,000 entities, and businesses objected that they were too broad and overlapped with other federal and state reporting rules. Final rules were delayed past their October 2025 deadline to 2026 and slowed further by the 2026 lapse in Homeland Security funding. Supporters say mandatory reporting is overdue, while critics want a narrower rule and one report that satisfies every agency.