CIRCIA Status in August 2026: No Final Rule and No Current 72-Hour Duty

TL;DR

• No CIRCIA final rule existed as of August 17, 2026. CISA says mandatory reporting begins only after the final rule goes into effect.
• The statute’s future architecture includes a 72-hour covered-cyber-incident report and a 24-hour ransom-payment report. The detailed 2024 implementation text remains proposed.
• The federal banking agencies’ 36-hour notification rule is already operative and should remain active in incident playbooks.
• Prepare a conditional CIRCIA module now, but do not label it a current duty or promise a September effective date.

August 17, 2026 Status Update

CISA’s current CIRCIA status page says that covered entities will not be required to report covered cyber incidents or ransom payments until the final rule goes into effect.

The governing status is therefore:

Delete any playbook sentence that says CIRCIA reporting is now required or assigns the rule a September 2026 effective date. A planning target or forecast is not final agency action.

What the NPRM Proposes

The 2024 NPRM proposes that a covered entity would report:

• a covered cyber incident within 72 hours after it reasonably believes the incident occurred;
• a ransom payment within 24 hours after the payment; and
• supplemental information in circumstances defined by the final rule.

The proposal also addresses covered entities, covered incidents, report content, submission, preservation, enforcement mechanics, and harmonization. Those details may change. Build provisional controls from the NPRM, then conduct a legal and operational redline when final text appears.

Coverage Is Provisional

Financial services is a critical-infrastructure sector, but not every firm in or supporting the sector can be declared covered from that fact alone. The NPRM proposes a combination of criteria and exceptions.

A provisional coverage memo should identify:

• the exact legal entity;
• sector and services;
• the proposed criterion that may apply;
• any proposed exception;
• supporting facts and data owner;
• source and review date; and
• a mandatory final-rule revalidation step.

Do not hard-code a proposed size threshold into policy as though it were final.

Keep the Existing 36-Hour Rule Live

The banking agencies’ computer-security incident notification rule is current law for covered banking organizations. The OCC’s Bulletin 2021-55 explains that an OCC-supervised bank must notify the OCC as soon as possible and no later than 36 hours after determining that a computer-security incident is a notification incident. Parallel requirements apply for Federal Reserve- and FDIC-supervised banking organizations.

The future CIRCIA and existing bank rules differ:

An incident can eventually require both analyses. One cannot be substituted for the other unless final law and any harmonization arrangement say so.

Build a Conditional CIRCIA Module

1. Use one intake and separate legal analyses

Capture incident facts once, then route them through separate decision records for the banking rule, SEC disclosure, state breach laws, contractual notices, and future CIRCIA reporting.

2. Preserve decision timestamps

Record what was known, when it was known, who evaluated the trigger, and why the team reached its conclusion. Different clocks may begin at different points.

3. Map proposed fields to owners

Identify likely sources across security, infrastructure, legal, vendor management, communications, and finance. Do not discover during an event that no one owns ransom-payment or third-party-impact facts.

4. Test uncertainty

Use a scenario involving a critical provider, incomplete facts, changing recovery estimates, and possible ransom payment. Require the team to make the live 36-hour determination and a separately labeled future CIRCIA assessment.

5. Add a final-rule trigger

Assign an owner to monitor the CISA FAQs and Federal Register. Final publication should trigger coverage review, legal redline, procedure changes, training, and a new exercise.

Every provisional page should display: NOT A CURRENT CIRCIA FILING DUTY—REVALIDATE AGAINST THE EFFECTIVE FINAL RULE.

So What?

CIRCIA readiness is legitimate regulatory-change work. Treating an NPRM as an operative reporting rule is not.

Keep current notification obligations functioning. Build a conditional CIRCIA process using the proposal. Revalidate scope, triggers, fields, harmonization, and dates when CISA issues final text.

The Incident Response & Breach Notification Kit can organize trigger matrices, escalation, and evidence. Any CIRCIA module must remain conditional until the final rule is effective.

Primary sources: CISA CIRCIA status page | CISA CIRCIA FAQs | 2024 CIRCIA NPRM | 2026 town-hall notice | OCC Bulletin 2021-55