type: incident · created: 2026-07-26 · updated: 2026-07-26 · tags: [incident, cisa, circia, regulation, incident-reporting, critical-infrastructure, policy] · confidence: high · affected_sectors: [government, critical-infrastructure, technology, finance, healthcare, energy] · au_impact: false
CISA Finalising Cyber Incident Reporting Regulations (CIRCIA) September 2026
CISA continues working toward finalising regulations implementing the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) of 2022, with a final rule now expected in September 2026.
Summary
| Field | Detail |
|---|---|
| Regulation | CIRCIA implementing regulations |
| Agency | CISA |
| Expected Final Rule | September 2026 |
| Authority | Cyber Incident Reporting for Critical Infrastructure Act of 2022 |
The regulations will mandate cyber incident reporting for critical infrastructure owners and operators, establishing requirements for when and how to report covered cyber incidents to CISA.
Source
- [Hunton Privacy & Cybersecurity Law Blog(https://www.hunton.com/privacy-and-cybersecurity-law-blog/) — July 17, 2026