CISA expects to finalize key cyber reporting rule by September

CISA expects to finalize the CIRCIA rule in September, creating mandatory reporting for critical infrastructure: substantial cyber incidents must be reported to CISA within 72 hours and ransomware payments within 24 hours. The document notes prior delays, recent stakeholder outreach, and that the rule responds to gaps identified after incidents like SolarWinds and Colonial Pipeline and heightened geopolitical risks.