Policy Briefing — U.S. Cyber Incident Reporting for Critical Infrastructure Act Signed

On 15 March 2022 the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) became law as part of the Consolidated Appropriations Act. The statute directs the Cybersecurity and Infrastructure Security Agency (CISA) to require covered critical infrastructure owners and operators to report substantial cyber incidents within 72 hours and ransomware payments within 24 hours. It also gives CISA subpoena authority to compel reports, establishes liability protections, and sets timelines for notice of supplemental information.

The law launches a rulemaking that will define covered entities and reportable incidents, with a two-year window for final rules. Security leaders should begin aligning incident response playbooks to rapid-reporting expectations and inventorying what telemetry and forensic artifacts will be necessary to satisfy CISA requests.

• Congress.gov bill page provides the enacted statutory text and timeline triggers.
• CISA CIRCIA overview summarizes reporting thresholds, enforcement tools, and forthcoming rulemaking milestones.