CISA's CIRCIA Rule Just Reached the White House. Now You Might Be Running Two Incident Clocks
October 23, 2026
Rodney Hall, COO— AI-assisted and reviewed prior to publication.
If your organization is both publicly traded and part of a critical infrastructure sector, a single breach could soon trigger two separate federal reporting clocks running at once. CISA sent its final Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule to the White House for review on October 1, 2026, meaning the long-delayed 72-hour reporting requirement could become enforceable within months, stacking on top of the SEC's existing four-business-day rule for public companies.
What Is CIRCIA, and Has the 72-Hour Clock Actually Started?
Not yet, but the wait is nearly over. The statute requires a covered entity to report a covered cyber incident to CISA "not later than 72 hours after the covered entity reasonably believes that the covered cyber incident has occurred," according to the Federal Register's CIRCIA reporting requirements notice. That clock does not start until CISA publishes the final rule and it takes effect, and CISA has missed its own deadlines repeatedly, pushing past an original October 2025 target before sending the rule to the Office of Management and Budget for final review this October, according to HIPAA Journal's reporting on the submission.
The scope is large by design. CIRCIA covers 16 critical infrastructure sectors, and CISA has estimated the rule will reach roughly 316,000 entities, with thresholds generally tied to company size and revenue that vary by sector, as HIPAA Journal's coverage of the final rule details. For healthcare specifically, that includes hospitals with 100 or more beds and any critical access hospital regardless of size. OMB review typically moves faster than the rulemaking that preceded it, and reporting on the rule's path through White House review notes the agency expects publication before year end, though the exact text of what a report must contain is still not public.
Do You Have to Tell the SEC and CISA About the Same Breach?
Potentially, yes, and on two different timelines triggered by two different legal standards. Public companies have been living under the SEC's rule since December 2023: a registrant must disclose a material cybersecurity incident on Form 8-K under Item 1.05 generally within four business days of determining that the incident is material, not within four days of discovering it, as the SEC's own announcement of the rule makes clear.
That distinction between discovery and determination matters more than it sounds. A review of the rule's first year found the average gap between detecting an incident and filing under Item 1.05 ran 7.88 business days, with a median of 4.5 business days, because the materiality assessment itself takes time, according to a review of Form 8-K cybersecurity filings. CIRCIA uses a different trigger entirely: reasonable belief that a covered incident occurred, not a formal determination of materiality to investors. A company that sits in a CI sector and is also publicly traded will likely need to run both assessments in parallel, on different legal theories, reporting to different audiences, once CIRCIA takes effect.
Here is how the two clocks compare on paper, recognizing that CIRCIA's exact reporting content is still under White House review:
| SEC Item 1.05 (Form 8-K) | CIRCIA Covered Incident Report | |
|---|---|---|
| Trigger | Materiality determination | Reasonable belief an incident occurred |
| Deadline | 4 business days from determination | 72 hours from reasonable belief |
| Audience | Investors, via public filing | CISA, non-public |
| Who's covered | All U.S. public companies | ~316,000 entities across 16 CI sectors |
| Status | In effect since Dec. 2023 | Final rule in OMB review as of Oct. 2026 |
Why Your Incident Response Plan Needs a Named Owner for Each Clock
The hard part is not knowing the deadlines exist. It is having a workable process that can hit both of them without one assessment stalling the other. NIST's rewritten incident response guidance makes this explicit by treating communication and coordination as a core function rather than an afterthought bolted onto containment. Its framework calls for legal, privacy, communications, and executive leadership to have defined roles during an incident, not just the technical responders, because legal needs to advise on notification requirements while privacy assesses whether personal data was involved, according to an analysis of the updated NIST guidance. That guidance, finalized by NIST in April 2025, replaced the old four-phase incident response model specifically because incident handling now has to function as continuous risk management, not a linear checklist that ends when the server is clean.
Translate that into practice and a few gaps show up fast in most incident response plans:
- No one has been named as the single person authorized to start the CIRCIA 72-hour clock by declaring reasonable belief, separate from whoever runs the SEC materiality determination.
- Tabletop exercises still simulate a single disclosure deadline instead of two clocks with different triggers running on the same incident timeline.
- Legal language for a CIRCIA-style report has never been drafted in advance, even though the SEC-side disclosure language usually has.
- Retention plans have not accounted for the record-keeping period CISA has proposed alongside the reporting deadline.
- Sector-specific overlap, like HIPAA's 60-day breach notification clock for healthcare entities, has not been mapped against the new federal deadline.
None of this requires waiting for CISA to publish final text. The 72-hour and 24-hour deadlines are fixed in the statute itself and cannot change during OMB review, so a team can build the escalation path, name the decision-makers, and run the exercise now, then slot in CIRCIA's specific reporting fields once they're published.
What This Means for the People Running Incident Response
This is the part that tends to get missed in the compliance conversation: someone still has to actually do the work of triage, evidence collection, and timeline reconstruction fast enough to feed both the legal team's materiality call and the operational team's reasonable-belief determination. That is squarely an incident handling discipline, not just a governance one. A handler who can establish a defensible incident timeline within hours, not days, is what makes either clock achievable at all.
That is a different skill profile than it was even two years ago, closer to regulatory-aware incident handling than pure forensics. Training built around EC-Council's Certified Incident Handler program covers the operational side of this directly: building the incident timeline, coordinating with legal and communications under deadline pressure, and documenting decisions in a way that holds up if a regulator asks why a determination took as long as it did. If you're mapping out where this fits into a broader study plan, the curriculum overview and FAQ is a reasonable place to start, and you can start training whenever you're ready to build that timeline-and-coordination skill set rather than learning it live during an actual incident.
Nobody knows yet exactly what a CIRCIA report will require CISA to see, because the text under OMB review has not been made public. What is already fixed is the 72-hour clock itself, the scope of entities it will touch, and the fact that it will not replace the SEC's rule for companies that fall under both. Waiting for the Federal Register notice before building the internal process is the one option that guarantees you're building it under deadline pressure instead of ahead of it.