CISA submits final CIRCIA rule to OMB for review

What happened

• The Cybersecurity and Infrastructure Security Agency completed its draft of the final CIRCIA rule on 1 October 2026.
• The draft was forwarded to the Office of Information and Regulatory Affairs for OIRA review.
• The rule will establish mandatory reporting requirements for covered critical‑infrastructure entities.
• Publication of the final rule follows OIRA clearance and will trigger compliance deadlines.

Why it matters

Operators of critical infrastructure will soon face a statutory duty to report cyber incidents to CISA, mirroring obligations already imposed on other sectors under CIRCIA. Entities should assess current incident‑response processes against the forthcoming reporting thresholds.

Business impact

Failure to meet the new reporting obligations could expose organisations to enforcement actions and reputational damage, while timely reporting may mitigate regulatory risk and improve incident‑response coordination.

What to check

1. 1

   review reporting thresholdsHigh priority

   Determine whether your organisation falls within the CIRCIA definition of covered critical infrastructure and identify the incident types that must be reported.

2. 2

   update incident‑response planHigh priority

   Incorporate the specific data elements, timelines and submission procedures outlined in the final rule once it is published.

3. 3

   train relevant staffMedium priority

   Ensure that security, legal and communications teams understand the new reporting obligations and internal escalation paths.