CIRCIA Status in August 2026: No Final Rule and No Current 72-Hour Duty

TL;DR

• No CIRCIA final rule existed as of October 22, 2026. The September 2026 target passed. CISA says mandatory reporting begins only after the final rule goes into effect.
• The statute’s future architecture includes a 72-hour covered-cyber-incident report and a 24-hour ransom-payment report. The detailed 2024 implementation text remains proposed.
• The federal banking agencies’ 36-hour notification rule is already operative and should remain active in incident playbooks.
• The proposal’s financial-sector criterion reaches banks, credit unions, and money services businesses regardless of size. Prepare a conditional CIRCIA module now, but don’t label it a current duty or guess an effective date.

October 22, 2026 Status Update

CISA’s CIRCIA status page says covered entities will not be required to report covered cyber incidents or ransom payments until the final rule goes into effect. It says CISA “continues to work on the final rule,” that multiple funding lapses affected its rulemaking work, and that updates will come through CISA.gov/CIRCIA. It gives no target date.

The timeline so far:

A Unified Agenda entry is a planning target, not final agency action. This one has already slipped, which is why no specific effective date belongs anywhere in your playbook.

The governing status is therefore:

Delete any playbook sentence that says CIRCIA reporting is now required or assigns the rule an effective date.

What the NPRM Proposes

The 2024 NPRM proposes, in draft 6 CFR part 226:

Reports would go through CISA’s web-based CIRCIA Incident Reporting Form. CISA estimated that about 316,244 entities would be covered and would file about 210,525 reports over the analysis period. That’s the scale of the program it’s trying to stand up.

What counts as a covered cyber incident is the load-bearing definition. CISA’s Covered Cyber Incident Fact Sheet describes a “substantial” incident as one that causes:

• a substantial loss of confidentiality, integrity, or availability;
• serious impacts to safety or operational resilience;
• a disruption of business or industrial operations; or
• unauthorized access through a compromise of a cloud provider, managed service provider, third-party data host, or the supply chain.

That fourth prong matters most for banks and fintechs. Your core platform or payment processor gets hit, and the proposed threshold can be met even though nobody touched your own perimeter. Build vendor-incident intake into the provisional module now, and recheck the prong against final text.

Proposed preservation duty

The proposed preservation requirement (226.13) is where many incident teams will feel the rule first. A covered entity would have to preserve communications with the threat actor, indicators of compromise, relevant logs, forensic artifacts, and related records starting from the date it reasonably believes a covered incident occurred (or the ransom was paid). The draft period is at least two years from the most recent required report. That applies even if the entity uses the substantially similar reporting exception. Compare that with your current forensic retention: many playbooks keep incident artifacts only as long as the case is open.

Proposed enforcement

The proposal sets out a request-for-information and subpoena process for entities that don’t report, and treats knowingly false statements in a CIRCIA report as subject to 18 U.S.C. 1001. Those mechanics may change in the final rule.

The proposal also addresses report content, submission, and harmonization in detail. Build provisional controls from the NPRM, then conduct a legal and operational redline when final text appears.

Coverage Is Provisional

Financial services is a critical-infrastructure sector, but not every firm in or supporting the sector can be declared covered from that fact alone. Proposed 226.2 would apply to an entity in a critical-infrastructure sector that either:

1. exceeds the small business size standard for its NAICS code under the SBA’s rules at 13 CFR part 121; or
2. meets a sector-based criterion, regardless of which sector the entity thinks it belongs to.

The proposed financial services criterion (226.2(b)(7)) lists:

Two things follow for practitioners. First, a $300 million community bank doesn’t escape the proposal by being small: the sector criterion would apply regardless of size. Second, fintechs that hold an MSB registration would be in scope under the proposal even if they’re not banks. A fintech that is neither an MSB nor a bank would fall back to the size test, which turns on its NAICS code.

A provisional coverage memo should identify:

• the exact legal entity;
• sector and services;
• the proposed criterion that may apply;
• any proposed exception;
• supporting facts and data owner;
• source and review date; and
• a mandatory final-rule revalidation step.

Do not hard-code a proposed size threshold into policy as though it were final.

Keep the Existing 36-Hour Rule Live

The banking agencies’ computer-security incident notification rule is current law for covered banking organizations. The OCC’s Bulletin 2021-55 explains that an OCC-supervised bank must notify the OCC as soon as possible and no later than 36 hours after determining that a computer-security incident is a notification incident. Parallel requirements apply for Federal Reserve- and FDIC-supervised banking organizations.

The future CIRCIA and existing bank rules differ:

An incident can eventually require both analyses. One can’t substitute for the other unless final law and a harmonization arrangement say so.

The proposed substantially similar reporting exception

Proposed 226.4(a) would let a covered entity satisfy CIRCIA by reporting to another federal agency under a “CIRCIA Agreement” between CISA and that agency. CISA would have to find that the other agency’s rule requires substantially similar information within a substantially similar timeframe, and that an information-sharing mechanism exists. The entity would be responsible for confirming that the agreement applies to it.

Read that against the 36-hour rule. Under OCC Bulletin 2021-55, the 36-hour notice goes “through email, telephone, or other similar methods,” and the bulletin prescribes no report content. CIRCIA’s proposed report fields run for pages. Whether it would ever qualify depends on agreements that don’t exist yet. Plan for two filings and treat any exception as upside.

Worked example: core processor ransomware

A state member bank’s core processor is hit by ransomware on a Friday night. Online banking and card authorization go down for six hours.

• Now: The processor, as a bank service provider, must notify the bank promptly because covered services were materially disrupted for four or more hours (OCC Bulletin 2021-55 describes the parallel OCC requirement). The bank decides whether this is a notification incident. If it is, it notifies the Federal Reserve within 36 hours of that determination. State breach-notification analysis starts if customer data was touched.
• Under the proposal: The bank would assess whether the outage is a substantial cyber incident, including the supply-chain prong. If it reasonably believes it is, the 72-hour CISA clock would start at that point, and preservation would start too. If the bank, or someone on its behalf, pays a ransom, a separate 24-hour report would apply.

Record both decision points in the incident log, with separate timestamps. The examiner will ask about the first today. CISA may ask about the second later.

Build a Conditional CIRCIA Module

1. Use one intake and separate legal analyses

Capture incident facts once, then route them through separate decision records for the banking rule, SEC disclosure, state breach laws, contractual notices, and future CIRCIA reporting.

2. Preserve decision timestamps

Record what was known, when it was known, who evaluated the trigger, and why the team reached its conclusion. Different clocks may begin at different points.

3. Map proposed fields to owners

Identify likely sources across security, infrastructure, legal, vendor management, communications, and finance. Do not discover during an event that no one owns ransom-payment or third-party-impact facts.

4. Test uncertainty

Use a scenario involving a critical provider, incomplete facts, changing recovery estimates, and possible ransom payment. Require the team to make the live 36-hour determination and a separately labeled future CIRCIA assessment.

5. Add a final-rule trigger

Assign an owner to monitor the CISA FAQs and Federal Register. Final publication should trigger coverage review, legal redline, procedure changes, training, and a new exercise.

6. Check forensic retention

Compare current incident artifact retention to the proposed two-year preservation period. If your forensic firm’s engagement letter controls retention, check that too.

For how CIRCIA would sit next to SEC, FFIEC-agency, and state notices, see our guide to multi-regulator notification sequencing and our walkthrough of building the 36-hour notification into the incident response program.

Every provisional page should display: NOT A CURRENT CIRCIA FILING DUTY—REVALIDATE AGAINST THE EFFECTIVE FINAL RULE.

So What?

CIRCIA readiness is legitimate regulatory-change work. Treating an NPRM as an operative reporting rule is not.

The rule is now a year past its statutory deadline, and the latest target has slipped. That doesn’t make it go away. Keep current notification obligations functioning. Build a conditional CIRCIA process using the proposal. Revalidate scope, triggers, fields, preservation, harmonization, and dates when CISA issues final text.

The Incident Response & Breach Notification Kit lists CIRCIA on its Regulatory Clocks tab as a proposed rule with no clock, beside the 36-hour, NYDFS and SEC clocks that apply now. Any CIRCIA module must remain conditional until the final rule is effective.

Primary sources: CISA CIRCIA status page | CISA CIRCIA FAQs | CISA Covered Cyber Incident Fact Sheet | 2024 CIRCIA NPRM | 2026 town-hall notice | Hunton on the Unified Agenda target | OCC Bulletin 2021-55