Cybersecurity Policy Report, CISA plans to gather more feedback on delayed cyber incident reporting rules, (Feb 13, 2026)

By Tom Leithauser

CISA will hold two general town halls on March 31 and April 2, and sector-specific town halls on other dates.

The Cybersecurity and Infrastructure Security Agency will hold seven virtual “town hall” meetings next month to gather additional stakeholder input as the agency attempts to finish work on a cyber incident reporting rulemaking.

The meetings will give “external stakeholders a limited additional opportunity to provide input on refining the scope and burden” of a rulemaking required by the 2022 Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), CISA said in a notice scheduled for publication in tomorrow’s Federal Register.

CIRCIA required CISA to issue final rules by Oct. 4, 2025, but CISA missed the deadline and now plans to issue rules sometime in May (CPR, Sept. 5, 2025).

One reason for the delay is that the notice of proposed rulemaking issued for public comment in 2024 was widely criticized by members of Congress and the private sector for its overly broad definitions of the entities that would be subject to the rule and the types of cyber incidents that would be reportable.

CIRCIA generally seeks to require critical infrastructure entities to disclose significant cyber incidents within 72 hours and ransomware payments within 24 hours. The disclosures would be confidential but would help CISA track cyber attack campaigns and warn critical infrastructure operators about imminent threats.

CISA plans two general town halls on March 31 and April 2 and sector-specific town halls on other dates, including the communications and financial services sectors on March 18 and the health care sector on March 17. The exact times for the meetings and registration information will be posted on www.cisa.gov/circia. Participants will be required to register at least two days prior to each town hall.

CISA doesn’t intend to reopen the NPRM for comments but said it had received “many written comments and requests from critical infrastructure sector entities and other stakeholders to directly engage CISA further on the CIRCIA rulemaking.”

“During the town hall meetings, CISA welcomes any specific, actionable improvements that CISA could implement in the final rule to clarify or reduce the burden of CIRCIA’s regulatory requirements while enhancing the federal government’s visibility into the cyber threat landscape for critical infrastructure sectors,” it said.

The agency is interested in hearing views on, among other things, which entities should be covered by the rule, examples of incidents that should be reported, and ways to harmonize the cyber incident reporting rule “with other existing federal or state local, tribal, or territorial (SLTT) laws, regulations, directives, or similar policies that require reporting of cyber incidents or ransom payments.”

RegulatoryActivity: CyberPrivacyFeed FederalLegislation RiskManagement FinancialIntermediaries DataPrivacy DataSecurity