CIRCIA Is Coming. Could You Report a Cyber Incident in 72 Hours?

Summary

 

Speaking at the Billington Cybersecurity Summit on Sept. 9, CISA Acting Director Nick Andersen said the agency is preparing to bring on hundreds of new employees. Priority goes to its cybersecurity, infrastructure security and emergency communications divisions and to regional field advisers (Cybersecurity Dive).

 

The bigger development for private-sector organizations is CISA's work to finalize the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule. The final rule is expected to be a "pared-back version" of the draft proposed in 2024. "CIRCIA continues to be a work in progress, but we're looking forward to being able to share more information on that very soon," Andersen said.

 

Under the 2022 law, covered entities will have to report substantial cyber incidents to CISA within 72 hours and ransom payments within 24 hours. The proposed rule applied across 16 critical infrastructure sectors, including financial services, healthcare and manufacturing. 

 

 

The InfoSight take: 72 hours starts when you know, and you have to know first.

 

A 72-hour reporting window sounds generous until you look at what it requires. Within that window, you need to detect the incident, confirm its scope, work out what was affected and document it well enough to report accurately. Organizations without round-the-clock visibility often find out about an incident days or weeks after it starts, and at that point the reporting deadline is only one of their problems.

 

Here's how InfoSight helps you get ready before the rule takes effect:

 

Incident Response. When an incident hits, InfoSight's responders move fast to contain the threat, determine scope and impact, and preserve the evidence and timeline your team needs to report accurately and on time.

 

24/7 SOC monitoring, Powered by AI, Fueled by Experts. Continuous detection and analyst investigation mean incidents are identified and scoped quickly, with the documentation trail a report requires.

 

Mitigator® gives you continuous visibility into vulnerabilities and risk, so you already know your exposure when an incident hits.

 

Purple Team SOCaaS puts your detection and escalation process under real pressure. You find out now, not during a live incident, whether your team could meet a 72-hour deadline.

 

For financial institutions and healthcare organizations already reporting under other regulators, CIRCIA adds another clock. The organizations that handle it well will be the ones that tested their process before they needed it.

 

Could your team meet a 72-hour reporting deadline today?