CISA moves deadline to May 2026 for issuing final rule implementing mandatory incident reporting regime

The Cybersecurity and Infrastructure Security Agency is getting an additional six months to finalize rules to implement a mandatory incident reporting regime for critical infrastructure based on feedback from stakeholders, according to a statement to Inside Cybersecurity.

“CISA has extended the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) rulemaking timeline to May 2026 to examine options within the rulemaking process to address Congressional intent and streamline CIRCIA’s requirements consistent with feedback on the notice of proposed rule...