CISA official says CIRCIA cyber reporting update is 'weeks' away

A CISA executive indicated an imminent update on the delayed CIRCIA rule that will require critical infrastructure operators to report major cyber incidents within 72 hours and ransomware payments within 24 hours; the rulemaking, originally due last year and now slipped to May 2026, may be revised following industry pushback, with the effort contextualized by high-profile attacks such as the Colonial Pipeline incident.