CIRCIA Incident Reporting: A Practical Guide for Covered Entities in 2024

There is a moment in every serious cyber incident where someone in the room asks: “Do we have to report this?”

That question used to have a fuzzy answer. Different regulators. Different timelines. Inconsistent guidance depending on your sector. Some organizations reported. Many did not.

The Cyber Incident Reporting for Critical Infrastructure Act of 2022, known as CIRCIA, changed that reality. If your organization qualifies as a covered entity, you now have a legal obligation to report specific cyber incidents to the Cybersecurity and Infrastructure Security Agency (CISA) within strict timeframes. Miss those windows and you are not just behind on paperwork. You are out of compliance with federal law.

This guide covers everything covered entities need to understand: what CIRCIA actually requires, who it applies to, what starts the reporting clock, and how to build a process that holds up under real pressure.

What Is CIRCIA and Why Did Congress Create It?

CIRCIA was signed into law on March 15, 2022, as part of the Consolidated Appropriations Act. Congress directed CISA to establish a centralized, mandatory cyber incident reporting framework covering critical infrastructure organizations across the United States.

Before CIRCIA, the federal government had very limited real-time visibility into serious cyber incidents affecting critical sectors. In most cases, reporting was entirely voluntary. When organizations did choose to report, they reported to different agencies depending on their sector, sometimes the FBI, sometimes a sector-specific regulator, and sometimes nobody at all. The result was a fragmented, incomplete picture that made national coordination difficult, especially during fast-moving attacks affecting multiple sectors at once.

CIRCIA addresses this problem directly. Its stated goal is to ensure CISA receives timely, actionable information about covered cyber incidents so the agency can analyze trends, issue warnings, and coordinate response at a national scale.

What this means practically is that cyber incidents at covered entities are no longer purely internal events. They carry external reporting consequences with hard legal deadlines attached.

The Two Reporting Timelines That Define CIRCIA Compliance

Understanding CIRCIA starts with understanding its two core reporting obligations. These are not guidelines or best practices. They are legal requirements with specific clocks.

The 72-Hour Covered Cyber Incident Report

When a covered entity reasonably believes it has experienced a covered cyber incident, it must submit a report to CISA within 72 hours of forming that belief.

Several things about this timeline are worth emphasizing carefully.

The clock starts when the organization reasonably believes an incident occurred, not when it has fully confirmed every detail. It does not start at remediation. It does not start when root cause analysis is finished. It starts with reasonable belief.

Incomplete information at the 72-hour mark is expected and acceptable. CISA understands that investigations take time. Supplemental reports can and should be submitted as new material facts emerge after the initial filing.

This is the part many organizations get wrong. They wait for forensic certainty before picking up the phone. By the time they have confirmed everything to their satisfaction, the legal deadline has already passed. CIRCIA was deliberately written to favor speed over completeness, because timely reporting is what allows CISA to do its job.

The 24-Hour Ransom Payment Report

If a covered entity makes a ransomware payment, a separate report is required within 24 hours of making that payment.

This obligation exists completely independently of the 72-hour incident report. Even if you have already submitted an incident report, a ransom payment triggers its own faster-moving deadline. Even when a payment is made through a third-party negotiator or legal counsel, the 24-hour clock still applies to the covered entity.

This distinction matters in practice because ransom payment decisions often happen well outside normal security team channels. Legal counsel, cyber insurers, and executives may authorize or coordinate a payment without directly looping in the team responsible for regulatory compliance. That disconnection is exactly the kind of gap that causes organizations to miss their 24-hour window without even realizing it.

Who Qualifies as a Covered Entity Under CIRCIA?

CIRCIA applies to covered entities, a term that sounds straightforward but requires careful analysis for each individual organization.

According to the Notice of Proposed Rulemaking published by CISA in April 2024, a covered entity is generally defined as an organization operating in one of the 16 critical infrastructure sectors designated by Presidential Policy Directive 21, and meeting certain size or operational impact thresholds established in the proposed rule.

The 16 critical infrastructure sectors identified under PPD-21 are:

• Energy, including electric, oil, and natural gas
• Healthcare and Public Health
• Financial Services
• Transportation Systems
• Communications
• Water and Wastewater Systems
• Information Technology
• Chemical
• Defense Industrial Base
• Emergency Services
• Food and Agriculture
• Government Facilities
• Critical Manufacturing
• Dams
• Nuclear Reactors, Materials, and Waste
• Commercial Facilities

The proposed rule generally excludes very small businesses in most sectors, though thresholds vary depending on sector classification. Healthcare, financial services, and critical manufacturing have lower thresholds than some other sectors because of their systemic risk profiles.

The practical advice here is straightforward. If your organization operates in or provides essential services to any of these sectors, do not wait for final regulatory clarity to begin preparing. Assess your potential coverage now, document your analysis in writing, and build reporting readiness regardless. If you later confirm you are not covered, the preparation still leaves your incident response program meaningfully stronger.

What Actually Qualifies as a Covered Cyber Incident?

What Actually Qualifies as a Covered Cyber Incident?

Not every security alert, anomaly, or attempted breach is reportable under CIRCIA. The regulation is focused on incidents that are substantial in nature, ones that cause real organizational impact rather than background noise.

Based on CISA’s proposed definitions, a covered cyber incident is generally one that meets one or more of the following conditions:

Substantial degradation of operations. The incident significantly impairs the covered entity’s ability to deliver its products or services to customers or constituents.

Disruption of business or industrial operations. This includes disruption caused by ransomware, denial of service attacks, or destruction of operational assets and systems.

Unauthorized access resulting in material impact. This covers unauthorized access gained through supply chain compromise, exploitation of third-party providers, or direct intrusion into the entity’s own systems.

Significant impact on confidentiality, integrity, or availability. The incident affects data or systems in a way that is material to the entity’s function, not incidental.

Looking at real-world examples helps make these definitions concrete. A regional hospital whose electronic health record system is encrypted and offline for 18 hours due to ransomware meets the threshold, and this is exactly the scenario that endpoint detection and response tools are designed to catch before systems go dark. A financial institution that discovers unauthorized access to customer account data meets it. A water utility whose SCADA system receives an unauthorized command affecting chemical treatment meets it. A manufacturing facility whose operational technology network is encrypted and production halts for 48 hours meets it.

By contrast, phishing attempts that are blocked before any system access occurs, routine external vulnerability scans, or brief outages caused by internal configuration errors are generally not covered cyber incidents under the proposed definitions.

The line between reportable and non-reportable is exactly why having a pre-defined internal severity classification system matters so much. If your team is still debating what counts as significant during an active incident, you have already burned through valuable reporting time.

The Real Operational Problem: Decision Paralysis Under Pressure

Here is something that most compliance guides do not say plainly. The biggest CIRCIA compliance risk for most organizations is not a deliberate decision not to report. It is decision paralysis when things are moving fast and nobody has clear authority.

During a serious cyber incident, multiple things happen at the same time. The security team is focused entirely on containment and stopping the bleeding. IT is working to restore systems and get the business operational again. Legal is asking for verified, documented facts before anyone says anything externally. Leadership wants a clear picture of business impact before authorizing any communication. The communications team is watching for media exposure. The cyber insurer’s breach coach has opinions on timing that may conflict with everyone else.

In that environment, if no single person owns the reporting decision and has documented authority to make it, the 72-hour clock expires while everyone is still in a room debating whether the incident is significant enough to warrant reporting.

CIRCIA’s “reasonably believes” standard was written with this exact reality in mind. It does not require certainty. It requires reasonable, good-faith judgment, and it requires that judgment to happen quickly.

How to Build a CIRCIA Reporting Process That Actually Works

Preparing for CIRCIA compliance is not primarily about technology. It is about building clear processes with real ownership before an incident ever happens.

Designate a Single Reporting Decision Owner

One person needs to be the CIRCIA Reporting Lead with a clearly identified backup. This person has explicit authority to determine whether an incident is reportable and to initiate the filing process without requiring committee consensus or executive sign-off on every step. Their role, authority, and escalation path need to be documented formally and reviewed at least annually.

Define Internal Reportability Criteria in Writing

Work with legal counsel to translate CIRCIA’s definitions into concrete internal criteria your team can apply quickly. What level of availability impact triggers reporting? What category of data exposure crosses the threshold? What operational disruption qualifies? Write these criteria down, review them against the final rule when it is published, and store them somewhere incident responders can access in the first hour of a serious event.

Build and Test a Reporting Data Template

Based on CISA’s proposed reporting requirements, covered entities should be ready to provide the following categories of information at the time of initial reporting:

• Organization name, critical infrastructure sector, and primary point of contact
• Date and time of incident discovery and estimated date of first occurrence
• Description of how the incident was detected and by whom
• Systems, networks, or data types affected
• Type of attack or access method, if known at the time of reporting
• Estimated operational and customer impact
• Containment and remediation actions taken so far
• Whether a ransom was demanded, and whether payment was made or is under consideration

Build this template before you need it. Populate it during tabletop exercises under real time pressure. The first time your team fills it out should not be at hour 48 of an active ransomware incident.

Organizations using a managed detection and response service have an advantage here – alerts with timestamps already exist, giving the reporting lead a documented starting point for when reasonable belief was formed.

Create a Dedicated Ransomware Payment Notification Path

The 24-hour ransom payment obligation needs its own separate workflow. The moment a payment decision enters any conversation, whether with legal, the insurer, or the executive team, the CIRCIA Reporting Lead needs to be part of that conversation immediately. Payment authorization and compliance notification should be simultaneous steps, not sequential ones.

Run Tabletop Exercises That Focus Specifically on the Reporting Decision

Most tabletop exercises test technical containment and recovery. Far fewer test the reporting decision itself under realistic time pressure. Run scenarios that specifically ask: How quickly can your team reach a reportability determination? Who makes that call if the designated person is unavailable? How long does it take to populate the reporting template with information actually available at the 48-hour mark of an incident? Where does that process break down?

Why Transparency and Documentation Protect You

CISA has stated clearly and publicly that the intent of CIRCIA is not punitive. Mandatory reporting exists to build a national picture of the threat environment so that information can be shared across sectors and defenses can be strengthened collectively.

Organizations that engage transparently, report on time, and submit accurate supplemental updates as investigations mature will be treated fundamentally differently from those that appear to delay or withhold information. That difference matters when CISA is assessing whether to exercise its subpoena authority under the statute.

This is not bureaucratic overhead. It is a defensible audit trail that demonstrates good-faith compliance if your process is ever reviewed by CISA or referenced in litigation. Organizations with a structured compliance tracking and reporting system already in place are significantly better positioned to produce this documentation under pressure.

Mistakes That Cost Organizations Their Compliance Standing

Most CIRCIA compliance failures come from the same predictable, avoidable errors.

Waiting for forensic certainty before reporting. The 72-hour clock does not pause for your investigation. Report on what you reasonably know and submit supplemental reports as facts become clearer.

Treating ransomware payment as a separate track from compliance reporting. The moment payment is made, a 24-hour clock is running. These two events must be procedurally linked.

Assuming existing regulations already cover you. HIPAA breach notification, SEC cyber disclosure rules, and state data breach laws are all separate from CIRCIA. Compliance with one does not constitute compliance with another.

Having no designated reporting owner with documented authority. When everyone is responsible, no one is accountable. Assign it clearly and put it in writing.

Never practicing under actual time pressure. A tabletop where your team has unlimited time to answer the reporting questions tells you almost nothing useful about how they will perform under a real 72-hour constraint.

Frequently Asked Questions About CIRCIA

What does CIRCIA stand for? CIRCIA stands for the Cyber Incident Reporting for Critical Infrastructure Act of 2022, enacted as part of the Consolidated Appropriations Act signed on March 15, 2022.

When exactly does the 72-hour reporting clock start? The clock starts when the covered entity reasonably believes a covered cyber incident has occurred. This is not tied to investigation completion, remediation, or root cause confirmation.

Does every ransomware attack require a report to CISA? Not every ransomware attack automatically meets the threshold for a covered cyber incident report. However, if a ransom payment is made at any point, a separate 24-hour ransom payment report is required unconditionally.

Can covered entities submit updated reports after the initial filing? Yes. CIRCIA anticipates that initial reports will be filed with incomplete information. Covered entities are expected to submit supplemental reports as substantial new information becomes available through the ongoing investigation.

Is CIRCIA’s final rule currently in effect? As of mid-2024, the final rule has not been published. CISA released its Notice of Proposed Rulemaking in April 2024. Organizations should monitor CISA’s official CIRCIA webpage for updates on the effective date and final regulatory requirements.

What enforcement authority does CISA have under CIRCIA? CIRCIA authorizes CISA to issue subpoenas compelling information from organizations that fail to meet reporting obligations. Willful non-compliance or repeated failure to report may be referred to the Department of Justice for further action.

The Bottom Line on CIRCIA Readiness

CIRCIA is not the most technically complex compliance obligation your organization will face. But it is one of the most time-sensitive, and time pressure is where most compliance programs break down in practice.

The organizations that will handle CIRCIA well are not necessarily the ones with the largest endpoint security investment ,they are the ones with clear internal processes and documented decision ownership.. They are the ones that made clear decisions before any incident happened: who owns the reporting call, what criteria trigger it, and what information will be ready to submit when the clock is running.

That kind of operational clarity is genuinely difficult to build in the middle of a crisis. It is straightforward to build right now.

Start with the decision owner. Write down your criteria. Build your template. Run the exercise under real time pressure. When an incident happens and the clock starts, your preparation will be what makes the difference.

References

1. Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), Congress.gov
2. CIRCIA Notice of Proposed Rulemaking, Federal Register, April 2024
3. CISA CIRCIA Overview and Reporting Guidance
4. Presidential Policy Directive 21, Critical Infrastructure Security and Resilience
5. CISA Ransomware Reporting Guidance