View Rule

The Cybersecurity and Infrastructure Security Agency (CISA) will finalize regulations to implement certain aspects of the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA).  Specifically, CIRCIA directs CISA to develop and implement regulations requiring covered entities to submit reports to CISA regarding covered cyber incidents and ransom payments.  CISA published the NPRM on April 4, 2024. CISA received significant public comments on the proposed rule, many of which emphasized the need to reduce the scope and burden of the proposed reporting requirements, improve harmonization of CIRCIA with other federal cyber incident reporting requirements, and clarify terms. CISA is considering the public comments and examining options for the rulemaking. Additional information about this rulemaking is available at www.cisa.gov/circia.

Statement of Need:

Congress directed CISA to promulgate regulations requiring covered entities to report covered cyber incidents and ransom payments to CISA.

Summary of the Legal Basis:

This regulation is statutorily mandated by 6 U.S.C. 681 et seq.

Anticipated Costs and Benefits:

CISA is continuing to assess the anticipated costs and benefits of the final rule.