CISA’s Critical Infrastructure Reporting Rule Remains Under Review
CISA’s proposed CIRCIA rule was submitted to OIRA on October 1, 2026, and remains under interagency review—not finalized or in effect. Contractors should monitor the rule while assessing state breach-notification deadlines, incident-response readiness, supplier controls, and potential False Claims Act exposure.
Key Signals
- CIRCIA rule remains under OIRA review after submission on October 1, 2026
- Prepare incident-response processes to support a potential 72-hour significant-incident reporting deadline
- California and Oklahoma breach-notification updates are in effect
- Review supplier security and data-handling practices against contract requirements
- Assess cyber representations and security practices for potential False Claims Act exposure
The federal cyber reporting framework for critical infrastructure is still developing. The Cybersecurity and Infrastructure Security Agency (CISA) submitted its Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule to the Office of Information and Regulatory Affairs (OIRA) on October 1, 2026, where it remains under interagency review. The available source does not describe the rule as finalized or currently effective. For government contractors and critical-infrastructure suppliers, the immediate procurement issue is therefore readiness: organizations should not treat a proposed federal reporting deadline as an operative requirement, but should plan for the possibility that a final rule will require significant-incident reporting within 72 hours.
Agencies
- Cybersecurity and Infrastructure Security Agency
- Office of Information and Regulatory Affairs
- U.S. Department of Justice
- Federal Communications Commission
- U.S. Department of Energy
Locations
- California
- Oklahoma
- Delaware
- Vermont
Sources
- 2026 US data security law recapAshurst Perkins Coie · Nov 06