#DFARS

Final CIRCIA Cyber Incident Reporting Rule Heads to the White House for Review

The U.S. Cybersecurity and Infrastructure Security Agency has submitted its final rule under the Cyber Incident Reporting for Critical Infrastructure Act to the White House Office of Management and Budget for regulatory review. This major milestone comes after missing an earlier September target and pushes the regulation closer to an expected publication before the end of the year. First mandated by Congress in 2022, the framework obligates entities across 16 critical infrastructure sectors to report substantial cyber incidents within 72 hours and any ransom payments within 24 hours. The baseline scope is massive, originally projected to impact nearly 300,000 organizations nationwide. The trajectory of the rule has faced significant headwinds and delays due to substantial pushback from both Congress and industry stakeholders concerning regulatory overlap. A July Government Accountability Office study highlighted that approximately 70% of 117 surveyed federal cybersecurity regulations contained overlapping reporting mandates, demonstrating the friction around harmonization. Sector-specific burdens remain a major talking point, particularly for defense industrial base entities already beholden to 72-hour reporting under Pentagon mandates. While CISA's framework theoretically allows a single submission to satisfy requirements via inter-agency agreements, experts note substantial hurdles due to differing reporting scopes, such as DFARS focusing specifically on controlled unclassified information. Furthermore, CIRCIA introduces distinct operational overheads, including mandatory ongoing follow-up updates as incident investigations develop and a stringent two-year data retention requirement, far exceeding standard defense baseline rules. Despite industry friction, White House cyber officials have emphasized ongoing efforts aimed at providing clarity and reducing redundant burdens across covered sectors.