Are CIRCIA's new reporting clocks effective now?

The official record checked shows the CIRCIA final rule in pending OIRA review, received 1 October 2026. “Final Rule” in a review-stage field does not mean that a final, effective rule has been published. OIRA review record.

CISA's implementation FAQ makes the rule's effective date important. This research therefore does not present the proposed reporting clocks as an active universal obligation. Existing sector, state and contractual notification duties can still apply independently. CISA FAQ.

What to do now: designate someone to monitor the official rule, record your potential coverage analysis, and make sure an incident process can capture discovery, decision and reporting timestamps. At final publication, review definitions, scope, reporting content, exceptions and effective dates together. Do not build a legal decision solely from a vendor's reporting dashboard.

Ask a supplier: how quickly can you provide the facts and records needed for the buyer's reporting decision, and who validates them? Contractual assistance should be useful even before a new rule takes effect.