Do we already have to report under CIRCIA?

No. CISA writes that until the effective date of the final rule, organizations are not required to submit covered cyber incident or ransom payment reports under CIRCIA. It still encourages voluntary reporting, through its portal, by email or by phone.

What deadlines does CIRCIA set?

Once the rule is in force, a covered entity will have to report a covered cyber incident no later than 72 hours after it reasonably believes the incident occurred, and a ransom payment within 24 hours of making it. The exact scope of covered entities will be set by the final rule.

What happens if CISA 2015 expires on December 11?

The 2015 information sharing law shields companies from lawsuits and regulatory penalties when they share threat information with federal partners. According to the industry groups quoted by Nextgov, a lapse makes companies more reluctant to share. The law already lapsed during the 2025 government shutdown.

Breakdown · Regulation

CIRCIA and CISA 2015: US incident reporting on hold

CISA revises its incident reporting form, the CIRCIA rule waits at the White House and the threat-sharing law expires December 11. What it changes for you.

By Sentrix · Published 2026-11-11

Three US developments this week touch the same question: when and how to report an incident. On November 9, CISA revised its incident reporting form. The final CIRCIA rule, which will make reporting mandatory for critical infrastructure, is still waiting for White House approval. And the law that protects threat information sharing, CISA 2015, expires on December 11. For an organization that operates in the United States or serves customers there, now is a good time to review its reporting plan.

What happened

A new form. According to Nextgov/FCW, CISA updated the form on its reporting portal to collect more detail and connect incidents that might otherwise look unrelated. New questions cover malicious software, intrusion techniques, insider threats and efforts to trick people into giving access. Duplicate questions were removed, and the form now incorporates MITRE ATT&CK, a catalog of attacker behavior that helps compare incidents.

The CIRCIA rule is waiting. Congress passed CIRCIA in 2022. CISA published its proposed rule on April 4, 2024. Again according to Nextgov, the final rule reached White House review on October 1, 2026 and remains pending, after a missed statutory deadline in October 2025. On its CIRCIA page, CISA restates the two planned deadlines:

Event	Planned reporting deadline
Covered cyber incident	72 hours after reasonably believing it occurred
Ransom payment	24 hours after the payment

CISA states that before the final rule takes effect, these reports are not mandatory, and it encourages voluntary reporting.

CISA 2015 is running out. The 2015 information sharing law shields companies from lawsuits and regulatory penalties when they share threat information with federal partners. According to Nextgov, it lapsed during the 2025 government shutdown, then was extended in steps to December 11, 2026. On November 1, 35 industry groups, including the US Chamber of Commerce and the American Bankers Association, asked Congress to extend it through 2035 in the defense bill. A second Nextgov article reports that this bill has stalled in the Senate.

Why it matters

Deadlines are tightening everywhere. 72 hours for CIRCIA, 24 hours for the early warning under the Cyber Resilience Act in Europe, and in Canada the obligations of the Critical Cyber Systems Protection Act and of PIPEDA for breaches of security safeguards. An organization present in several markets will have several clocks starting on the same incident.

The form shows what will be asked. Even before the final rule, the new form shows the expected level of detail: techniques used, access vector, insider role. A team that documents its incidents with ATT&CK will be ready faster. Comparing your own incident records with the questions on the form now, while no deadline applies, shows which facts you do not collect today.

Information sharing rests on a fragile legal basis. If CISA 2015 expires, companies that share indicators with the US government lose their protections. Industry groups expect less sharing. For your teams, that may mean less information coming from US partners, or one more legal review before sharing.

Uncertainty is no reason to wait. The exact content of the final rule is not public. But the 72 and 24 hour deadlines are written into the law, and internal preparation is what takes time.

What we think at Sentrix

Map your obligations by market. For each country and sector where you operate, note the authority, the deadline and the trigger. Our compliance automation module keeps that register current.
Write one process with several outputs. The same incident findings should feed every report. The shortest deadline sets the pace.
Document incidents with ATT&CK. Techniques, vector and timeline are recorded during the response, not afterwards. Our incident response service structures that log.
Prepare the ransom decision. A 24 hour deadline after a payment assumes the decision, its approvals and its documentation are already planned.
Have legal review your sharing. Before December 11, clarify what you share with US partners and on what basis, in case the law expires.
Rehearse. A tabletop exercise that runs the 24 and 72 hour clocks quickly shows where the process gets stuck.

The next step

Take your last real incident and time how long it took to gather the facts the new CISA form asks for. If it took more than 72 hours, the reporting plan needs work. To do it with us, contact us.

Sources

Frequently asked questions

Do we already have to report under CIRCIA?: No. CISA writes that until the effective date of the final rule, organizations are not required to submit covered cyber incident or ransom payment reports under CIRCIA. It still encourages voluntary reporting, through its portal, by email or by phone.
What deadlines does CIRCIA set?: Once the rule is in force, a covered entity will have to report a covered cyber incident no later than 72 hours after it reasonably believes the incident occurred, and a ransom payment within 24 hours of making it. The exact scope of covered entities will be set by the final rule.
What happens if CISA 2015 expires on December 11?: The 2015 information sharing law shields companies from lawsuits and regulatory penalties when they share threat information with federal partners. According to the industry groups quoted by Nextgov, a lapse makes companies more reluctant to share. The law already lapsed during the 2025 government shutdown.

Related pages

Let's talk about your compliance program.

Contact us