CISA submitted the rule on October 1, four years after Congress ordered it and a year past the statutory deadline.

 

What happened

The Office of Information and Regulatory Affairs recorded receipt of CISA's final rule under the Cyber Incident Reporting for Critical Infrastructure Act on October 1, 2026, logged under regulation identifier 1670-AA04 at the final rule stage. CISA sent it to the Office of Management and Budget after missing the September target it had set in the government's regulatory agenda, BankInfoSecurity reported. Congress passed the law in March 2022 with a statutory deadline of October 2025, which CISA pushed to May 2026 and then to September. The rule would require organizations in 16 critical infrastructure sectors, healthcare and public health among them, to report substantial cyber incidents within 72 hours and ransomware payments within 24 hours.

 

Going deeper

Review by the White House budget office is a procedural stage rather than publication. The rule does not take effect at this point, no compliance date starts running, and the text can still change before it appears. What the submission signals is that the drafting is finished and the decision has moved to the final approval step. CISA developed the rule with the agencies responsible for each of the 16 sectors, the Department of Justice, and the Cyber Incident Reporting Council, and received more than a thousand public comments on the proposal. Much of that response criticized the scope as too broad and the definitions as unclear, and objected to the overlap with reporting rules organizations already follow.

 

What was said

The White House has "a tremendous partnership" with the Department of Homeland Security and CISA on the rule, which is aimed at "providing clarity to industry," National Cyber Director Sean Cairncross said at a USTelecom cybersecurity event on September 29, as reported by Federal News Network. He said considerable attention had gone into harmonizing the reporting structure so the final requirements fit alongside rules already in force.

 

In the know

Defense contractors show the overlap problem the final rule is meant to address. Those organizations already report cyber incidents to the Pentagon within 72 hours, and CISA has acknowledged that CIRCIA will likely create a second reporting requirement for them, according to BankInfoSecurity. The two regimes differ beyond the duplication, since CIRCIA would require follow-up reports as new details emerge and two years of incident data retention, against 90 days under the existing defense rules. The same analysis argued that genuine harmonization requires CISA to accept less information than the proposal set out to collect.

 

The big picture

Healthcare organizations would be adding a third clock to the two they already run. The Breach Notification Rule gives covered entities up to 60 days from discovery to notify affected individuals, under HHS requirements, and the trigger is unauthorized access to protected health information. CIRCIA would start at 72 hours from the point an organization reasonably believes a substantial incident has occurred, which is a different trigger as well as a far shorter window, and it does not depend on patient data being involved. Federal auditors have already documented the wider problem, finding that roughly 70% of the 117 federal cybersecurity regulations they examined contain redundant reporting requirements, with 80 rules carrying at least 125 distinct reporting obligations between them, in a report published by GAO. Compliance teams would benefit from mapping which obligations they already carry and who files each one, since those first 72 hours overlap exactly with containment work.

 

FAQs

What counts as a substantial cyber incident?

The proposal defined it around actual impacts such as serious loss of confidentiality, integrity, or availability, disruption to operations, or unauthorized access through a service provider or supply chain compromise. Attempted intrusions that cause none of those effects fall outside it, and the final text may refine the threshold.

 

Does a CIRCIA report replace HIPAA notification?

No. The two run to different agencies on different triggers and timelines. A CIRCIA report concerns a substantial cyber incident whether or not patient data was involved, while HIPAA notification turns on unauthorized access to protected health information.

 

When would compliance actually begin?

Not at White House review. The rule takes effect after publication, and the proposal sets applicability dates by category of covered entity, so the obligation would start on a defined date after the final text appears rather than immediately.

 

Which healthcare organizations would be covered?

The proposal applied to entities in the 16 critical infrastructure sectors above small business size thresholds, which would reach most hospitals, health systems, and larger provider organizations. CISA estimated the rule would affect more than 300,000 businesses across all sectors.

 

What should an organization do before the rule is final?

Establish which reporting obligations it already carries and to whom, who holds responsibility for each, and whether the information needed for a 72-hour report could be assembled during an active incident. That mapping is useful regardless of what the final text says.