CISA Delays Cyber Incident Reporting Rule for Critical Infrastructure

CISA plans to delay the publication of its cybersecurity incident reporting rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022. According to Inside Privacy, an entry on the Spring 2025 Unified Agenda released on 4 September 2025 states that CISA currently plans to publish the Final Rule sometime in May 2026, and it likely will not go into effect until sometime afterwards.

The rule would apply to covered entities across the 16 U.S. critical infrastructure sectors, requiring them to report covered cyber incidents within 72 hours of discovery and covered ransom payments within 24 hours. The Final Rule had been expected by October 2025, with the statute mandating publication within 18 months of the Proposed Rule. The Proposed Rule was published on 4 April 2024, and the 18‑month window was thus a factor in the earlier expected timeline.