CISA's final CIRCIA incident-reporting rule is now at White House review
Today's focus: Cybersecurity, Data & Cloud Security. CISA's final Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule (RIN 1670-AA04) was received by the White House Office of Information and Regulatory Affairs on 1 October 2026 and shows as Pending Review on reginfo.gov. Nothing is binding until it publishes in the Federal Register.
Why It Matters
OIRA review is the last step before publication. Under Executive Order 12866 it can run up to 90 days and can be extended, so publication could come at any point. CIRCIA's statute calls for covered entities to report covered cyber incidents within 72 hours and ransom payments within 24 hours, and the final rule will set who is covered and how the reporting ramps up.
For compliance teams and CISOs, the practical risk is a short runway: the rule can publish with little warning, and incident-response runbooks need a 72-hour clock and a ransom-payment trigger that are already staged.
Also today:
UK Cyber Security and Resilience Bill: the government lost two votes at the House of Lords Report stage on 26 October. Third Reading is scheduled for today (provisional), then the Commons considers the Lords amendments.
FedRAMP CR26: the Vulnerability Detection & Response/Enumeration "Obtain & Maintain" date is 7 December 2026, 35 days out.
Italy NIS2: the basic security measures milestone under D.Lgs. 138/2024 passed on 31 October. Attention now shifts to ACN supervision.
Action Items
Stage your reporting clocks — Confirm your incident-response plan can meet a 72-hour incident report and a 24-hour ransom-payment report.
Watch for publication — Track reginfo.gov (RIN 1670-AA04) and the Federal Register for the rule leaving OIRA.
Check FedRAMP readiness — Confirm every 20x and Rev5 offering meets CR26 VDR/VER requirements by 7 December.
Get the full analysis. Pro subscribers receive the complete deep dive, all 5 action items, source documents, and jurisdiction-specific compliance checklists.
Subscribe to Pro to read the rest.
Become a paying subscriber of Pro to get access to this post and other subscriber-only content.
UpgradeA subscription gets you:
- Deep dives of each updated regulation
- Source verification documents
- Extended jurisdiction-specific analysis
- Compliance deadline tracker
- Regulation crosswalk