What Does CIRCIA Require—and How Can You Prepare for Reporting Cyber Incidents?

**Executive summary:** The document explains the Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA), detailing who is a covered entity, the 72-hour reporting requirement for substantial cyber incidents and 24-hour requirement for ransomware payments, and how supply-chain compromises can trigger reporting. It outlines steps to prepare—confirm coverage, update incident response playbooks, improve vendor visibility, and preserve forensic evidence—and references SecurityScorecard's products (SCDR and MAX) as tools to help meet compliance and monitoring needs.