US CIRCIA – Cyber Incident Reporting for Critical Infrastructure Act of 2022
Status: Final rule under OMB/OIRA review (submitted 1 Oct 2026); reporting not yet mandatory
Requires covered critical infrastructure entities to report covered cyber incidents to CISA within 72 hours and ransom payments within 24 hours once CISA's final rule takes effect. CISA sent the final rule to OMB/OIRA for review; until publication and effectiveness, reporting remains voluntary.
Who it applies to
- Covered entities across the 16 US critical infrastructure sectors (definition set by final rule)
Why it matters for OT
Energy, water, manufacturing and transportation operators should map OT incident detection to the 72h clock.
Controls affected & IEC 62443 mapping
| Requirement | Indicative IEC 62443 reference |
|---|---|
| 72-hour covered incident report; 24-hour ransom payment report | IEC 62443-2-1 incident handling; 62443-3-3 SR 6 |
IEC 62443 mappings are editorial and indicative.
Recent changes
CIRCIA final rule at OIRA
Reported submission of the final rule for OMB review; no publication date yet. Verify against reginfo.gov.
Sources
- CISA – CIRCIA cisa.gov
- CISA – CIRCIA FAQs cisa.gov
- Inside Privacy – CISA submits final CIRCIA rule for OMB review (secondary) insideprivacy.com
Monitored for changes: cisa.gov. Data file: data/regulations/circia.yaml. Not legal advice.
Get CIRCIA changes in your inbox
What changed in OT/ICS regulation this week, who it applies to, the deadlines, and which IEC 62443 controls it touches — plus a short CISA ICS advisory digest. One email, every week. No spam.
Free. Unsubscribe any time. See privacy.