In May 2026, the Cybersecurity and Infrastructure Security Agency, or CISA, published a revised schedule for June stakeholder town halls as it continues refining its proposed rule under the Cyber Incident Reporting for Critical Infrastructure Act, known as CIRCIA.
The rule is not final; however, it would create federal reporting obligations for in-scope covered entities. Specifically, it could create federal reporting obligations for certain covered entities in critical-infrastructure sectors after covered cyber incidents and ransomware payments, which is why companies in the affected sectors are paying close attention to where the rule lands.
Under CISA’s proposed framework, a covered entity would generally need to report a covered cyber incident within 72 hours after reasonably believing it occurred. A covered entity that makes a ransom payment, or has one made on its behalf, would generally need to report that payment within 24 hours after it is disbursed.
CISA is still working through major details, including which organizations will be covered, what types of incidents will meet the reporting threshold, and how the final rule can work alongside existing federal, state, local, tribal, and territorial reporting requirements without creating unnecessary duplication.
That is the reason this matters now. An organization’s cybersecurity governance must evolve to handle cyber incident reporting as CIRCIA moves toward a formal and time-sensitive model. The questions companies face during an incident increasingly extend well beyond the cybersecurity team and are driven, managed, and anticipated from a mature cybersecurity governance posture.
What CIRCIA Would Actually Cover
CIRCIA is aimed at certain entities operating in the nation’s critical-infrastructure sectors. CISA’s proposal addresses all 16 sectors, including healthcare and public health, financial services, energy, transportation, communications, information technology, critical manufacturing, food and agriculture, commercial facilities, government facilities, water and wastewater systems, and others.
That does not mean every company in those sectors will automatically be covered.
CISA is still considering the criteria that would determine whether an organization falls within the rule. The proposal includes a mix of sector-specific criteria and a possible size-based criterion, and the agency’s 2026 town halls were intended in part to gather feedback on whether those standards are targeted appropriately.
The same applies to the incidents that would have to be reported. The proposed framework focuses on substantial cyber incidents experienced by covered entities, not every phishing email, routine system issue, or unsuccessful attack. CISA has proposed examples of incidents that may or may not qualify, but those details could still change before a final rule is issued.
For organizations that may fall within the rule, the practical issue is not simply whether they can recognize an incident. It is whether they can determine quickly enough what happened, how serious it is, whether it fits the reporting criteria, and who needs to be involved while the facts are still developing.
A Reporting Deadline Creates a Whole-Business Response
A 72-hour reporting window may sound like a cybersecurity requirement, but a serious incident rarely stays inside IT.
A company may be dealing with compromised systems, a third-party vendor issue, ransomware, disrupted operations, customer questions, a possible data exposure, contractual notice obligations, insurance issues, or concern about revenue and service delivery. The security team may be focused on containment and technical investigation while other parts of the business are trying to understand what the event means operationally, legally, financially, and reputationally.
That work has to happen at the same time.
Legal may need to assess contractual obligations, regulatory exposure, and communications with outside counsel. Finance may need to understand recovery costs, operational interruption, potential revenue effects, customer credits, insurance coverage, or implications for financial reporting. Internal audit, risk, compliance, and governance teams may need to understand how the incident was escalated, what decisions were made, and whether the company can document its reasoning if questions arise later.
When an incident involves a cloud provider, payment processor, managed service provider, critical customer system, or business partner, the process can become even more complicated. The organization may need to make decisions before every technical detail is known, while still avoiding speculation or public statements that go further than the available facts support.
That is why cyber incident readiness is not just about having an incident-response plan. It is about knowing how technical information moves through the organization, who can assess business impact, who has decision-making authority, and how the company will document its response while the situation is unfolding.
Public Companies Are Already Working Through Similar Questions
CIRCIA is still proposed, but public companies are already dealing with a live cyber-reporting framework through the SEC’s cybersecurity disclosure rules.
For domestic SEC registrants, a material cybersecurity incident generally must be disclosed on Form 8-K within four business days after the company determines the incident is material. The company must make that materiality determination without unreasonable delay after discovery, even though the four-business-day filing clock does not begin when the incident first occurs or is discovered.
Public companies also have annual disclosure obligations related to cybersecurity risk management, governance, board oversight, and management’s role in assessing and managing material cyber risk.
Those requirements do not apply to every organization, and the SEC rules are different from CIRCIA. Still, the operational challenge is familiar.
Companies need a process that connects technical facts to business decisions. Security may be able to explain what happened inside a network or system, but leadership also needs to understand whether the event affects operations, customers, revenue, contracts, financial reporting, regulatory obligations, or the company’s public disclosures.
The difficult part is not writing an incident-response policy. It is making sure the right people can use it under pressure.
Where Readiness Often Breaks Down
Most organizations understand they need cybersecurity controls, and many already have incident-response plans. The problems often appear at the handoff between the technical response and the business response.
Who decides when an incident needs executive attention? Who pulls together information from security, finance, operations, legal, customer-facing teams, and outside vendors? Who documents the analysis behind a reporting decision? Who prepares senior leadership and the board? Who makes sure the company’s communications reflect what it actually knows at that moment?
These questions should be settled before an incident happens.
For some organizations, that may mean clarifying internal ownership, updating escalation procedures, improving documentation, or running tabletop exercises that bring security, legal, finance, compliance, and leadership into the same room. For others, particularly those operating in higher-risk environments or managing multiple reporting obligations, it may mean adding targeted support in cybersecurity governance, IT audit, third-party risk, internal controls, financial reporting, compliance, privacy, incident-response coordination, or remediation work.
The point is not that every company needs to build a large new cyber reporting department. It is that organizations should know where the work will land when a serious cyber event creates technical, legal, financial, operational, and governance questions at the same time.
The Workforce Question Behind Cyber Readiness
CIRCIA is still proposed, and the SEC rules do not apply to every company. But the broader direction is relevant across industries.
Cyber incidents increasingly require organizations to make fast, well-documented decisions involving technology, operations, legal obligations, financial impact, risk, and leadership oversight. That means readiness can depend on more than security talent alone.
Organizations may need professionals with experience in cybersecurity governance and risk, incident-response coordination, IT audit, third-party risk, internal controls, SOX, financial reporting, regulatory compliance, privacy, enterprise risk management, or project-based remediation and documentation.
For organizations strengthening cyber-risk governance, reporting readiness, internal controls, audit support, or compliance coverage, TemPositions can help connect employers with finance, audit, risk, compliance, and technology professionals who understand the work that sits behind those processes.
This article is for general informational purposes only and does not constitute legal, cybersecurity, regulatory, or compliance advice. Organizations should consult qualified legal, cybersecurity, and regulatory advisors when evaluating their specific obligations.
