What Is CIRCIA? CISA Incident Reporting Explained

What Is CIRCIA? Definition and Core Purpose

The Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) is a federal statute passed by the US Congress and signed into law on March 15, 2022, as part of the broader Consolidated Appropriations Act, 2022. Its primary purpose is to close a longstanding gap in the US government's visibility into cyber threats targeting the nation's most essential systems and services.

Unlike voluntary programs that rely on goodwill, CIRCIA imposes a mandatory reporting requirement on entities within critical infrastructure sectors. CISA, the enforcing authority, estimates that the final rule—published in the Federal Register in 2024—will affect over 30,000 organizations across 16 critical infrastructure sectors, including Chemical, Commercial Facilities, Communications, Critical Manufacturing, Dams, Defense Industrial Base, Emergency Services, Energy, Financial Services, Food and Agriculture, Government Facilities, Healthcare and Public Health, Information Technology, Nuclear Reactors, Materials and Waste, Transportation Systems, and Water and Wastewater Systems.

The law's core objectives are to:

• Enhance threat intelligence by providing CISA with timely, actionable data on real-world incidents.
• Identify systemic vulnerabilities and attack patterns across sectors.
• Enable proactive defense by alerting other critical infrastructure entities to emerging threats.
• Hold organizations accountable for proper incident detection and response.

CIRCIA is expected to cost-regulated entities an estimated $2.6 billion in compliance costs over the first 10 years, underscoring the need for automated compliance solutions to manage reporting obligations efficiently.

Who Must Comply with CIRCIA? Covered Entities

The final rule defines a covered entity as any person or organization that:

• Owns, operates, or controls a critical infrastructure system or asset designated by CISA under an existing sector-specific plan; and
• Meets the specific size, ownership, or functional criteria set forth in the rule for that sector.

CISA has adopted a two-pronged test for most sectors: an entity qualifies if it (1) is designated as part of that sector and (2) meets one of the following thresholds: employs more than 50 employees, is publicly traded, or is a state or local government entity. For sectors like healthcare, the entity is covered if it is subject to HIPAA and operates in the Healthcare and Public Health sector. For financial services, entities subject to GLBA or NYDFS 500 and designated as critical infrastructure are covered.

At the time of writing, CISA is still finalizing the definitive list of covered subcategories and thresholds through the rulemaking process. However, organizations in the following categories are almost certainly covered:

• Energy: Electric utilities, natural gas pipelines, nuclear power plants, and petroleum refineries.
• Healthcare & Public Health: Major hospitals, pharmaceutical manufacturers, and health insurance entities.
• Financial Services: Large banks, credit unions, clearinghouses, and financial market utilities.
• Transportation: Major airports, transit authorities, railroad operators, and pipeline operators.
• Water & Wastewater: Large municipal water systems and wastewater treatment facilities.
• Information Technology: Cloud service providers, data centers, and major IT service companies.
• Communications: Major telecommunications carriers, internet service providers, and broadcasters.

For a complete assessment of whether your organization falls under CIRCIA, we recommend a comprehensive compliance assessment from a qualified partner like CyberSilo.

What Incidents Trigger CIRCIA Reporting?

CIRCIA establishes two distinct reporting obligations based on incident type:

Covered Cybersecurity Incidents — 72-Hour Report

A covered cybersecurity incident is defined as any incident that:

• Substantially affects the covered entity's ability to function or operate.
• Gives rise to a reasonable belief that the incident has or is likely to compromise the confidentiality, integrity, or availability of the entity's information system.
• Is reasonably likely to result in one or more of: significant harm to a critical infrastructure system, a substantially increased risk of harm to public health or safety, or a significant economic impact on the covered entity or the public.

Examples of reportable incidents include:

• Ransomware attacks that encrypt critical systems for more than 24 hours.
• Data breaches involving sensitive personal information or critical operational data.
• Denial-of-service attacks that render a covered system unavailable for an extended period.
• Supply chain compromises that affect the integrity of software or hardware used in critical operations.

The report must be submitted to CISA within 72 hours of the covered entity reasonably believing the incident has occurred. This timeframe begins when the entity has enough information to know the incident is reportable—not from the moment of initial detection.

Ransomware Payment Report — 24-Hour Report

Separately, any covered entity that makes a ransomware payment—regardless of the amount or whether the payment is legal under other laws—must submit a report to CISA within 24 hours of making the payment. This report must include:

• The date, amount, and currency of the payment.
• The name and contact information of the ransomware variant used (if known).
• Any information the entity has about the threat actor.
• A description of the impact of the attack.

This provision is particularly significant because it removes the traditional wait-and-see approach to ransomware payments. Organizations must now have a pre-approved payment decision process and the ability to compile a report within a single day.

What Information Must Be Included in a CIRCIA Report?

CIRCIA requires a detailed report to CISA that includes, at a minimum, the following information:

• A description of the incident, including its suspected origin and timeline.
• The type of incident (e.g., ransomware, data breach, DDoS).
• The vulnerabilities exploited or methods used.
• The actual or potential impact on the covered entity's operations or systems.
• The identity (if known) of the threat actor or actors.
• Any indicators of compromise (IOCs) identified.
• Any contact information for the entity's designated reporting point of contact.
• Information about the entity itself (name, sector, location of covered system).

CISA is required to establish a secure portal for electronic submission, and entities can submit reports using a standardized format. The agency may also request follow-up information within 30 days of the initial report.

Importantly, CIRCIA provides limited liability protection for entities that file reports in good faith. Information shared with CISA is generally exempt from public disclosure under the Freedom of Information Act (FOIA), and cannot be used in civil lawsuits or criminal proceedings against the reporting entity. This protection is designed to encourage robust reporting without fear of legal exposure.

Penalties for Non-Compliance

Non-compliance with CIRCIA carries significant consequences:

• Civil penalties: CISA can impose civil fines of up to $500,000 per violation, per day. A violation is defined as the failure to submit a required report within the specified timeframe. For a 72-hour report, a violation accrues at the 72-hour mark and continues until the report is submitted.
• Enforcement actions: CISA can refer non-compliant entities to the Department of Justice for further legal action, including potential criminal referral.
• Reputational risk: CISA may publicly disclose the names of entities that are subject to enforcement actions, creating significant reputational damage.
• Loss of liability protection: Entities that willfully fail to report lose the legal protections afforded by the act.

Given the severity of these penalties, organizations must have a reliable, auditable reporting process in place before an incident occurs.

How CIRCIA Interacts with Other US Reporting Laws

CIRCIA does not exist in a vacuum. Covered entities must navigate a patchwork of overlapping federal and state reporting requirements:

• HIPAA Breach Notification Rule: Healthcare organizations that are both HIPAA-covered entities and CIRCIA-covered entities must report breaches to HHS OCR within 60 days and to CISA within 72 hours.
• NYDFS 23 NYCRR 500: Financial institutions regulated by New York must report cybersecurity incidents to the NYDFS within 72 hours and now also to CISA under CIRCIA.
• SEC Cyber Disclosure Rules: Publicly traded companies must report material cybersecurity incidents on Form 8-K within four business days and also file a CIRCIA report within 72 hours.
• State breach notification laws: Most US states require notification to affected individuals and state Attorneys General within 30-60 days of a breach involving personal information.

While CIRCIA reports are confidential and exempt from public disclosure, the same incident may trigger public reporting obligations under other laws. Organizations must coordinate their incident response process to satisfy all applicable requirements simultaneously.

To manage this complexity, CyberSilo's Threat Exposure Management platform integrates with your existing incident response workflows to automate CIRCIA reporting across multiple regulatory frameworks.

Building a CIRCIA Compliance Program

Establishing a compliant program requires a structured approach. Here is a phased process for achieving and maintaining CIRCIA readiness:

Leading organizations pair this workflow with automated compliance tools. CyberSilo's Threat Exposure Management solution can reduce CIRCIA report preparation time by an average of 60%, ensuring you meet the 72-hour deadline without straining your security team.

Frequently Asked Questions About CIRCIA

Preparing for CIRCIA Ahead of the Final Rule

While the final rule from CISA is expected in 2025, forward-thinking organizations are already taking proactive steps:

• Start gap analysis now: Assess current incident response and reporting capabilities against the proposed rule's requirements.
• Invest in detection automation: Implement ThreatHawk SIEM to automatically detect, classify, and compile incident data in real time.
• Engage with CISA: Participate in the ongoing rulemaking process by submitting comments and attending industry briefings.
• Update supply chain contracts: Require critical vendors and partners to maintain CIRCIA-compliant reporting processes, as supply chain incidents are explicitly covered.
• Allocate budget: CIRCIA compliance is a multi-year investment. Factor in costs for technology, training, and legal support.