The US Incident-Reporting Rule Keeps Slipping While CISA Loses a Third of Its Staff
CIRCIA's final rule missed October 2025, then May 2026, then a September target, as the agency that must enforce it shrinks and its info-sharing law runs on short extensions.
Key takeaways
- CISA missed its October 2025 target for the CIRCIA final rule and pushed it to May 2026; later sources cite September 2026.
- The agency has lost about 1,000 people, with proposed FY2026 headcount of 2,324 versus 3,292 before.
- The 2015 info-sharing law has survived only on stopgaps, most recently reported through December 11, 2026.
Congress ordered critical-infrastructure operators to report major cyber incidents to the government in 2022. Four years on, the rule that would make it real, from the Cybersecurity and Infrastructure Security Agency (CISA), still has not been finalised, and the agency writing it has shrunk by roughly a third.
A rule that keeps moving
The Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) requires covered entities to report significant incidents within 72 hours and ransomware payments within 24 hours. CISA was supposed to finish the final rule by October 2025. In a regulatory agenda update it pushed the target to May 2026, citing industry requests to narrow the scope, cut the burden and align with other federal reporting rules. A DHS funding lapse then postponed CISA's town halls, and the agency itself said that would likely delay the rule further.
Later coverage pointed to a September 2026 target in the Unified Agenda. One June 2026 update found that no final rule had been published as of June 18. We could not confirm publication since, so treat the status as pending.
An agency running thinner
The delay lands as CISA contracts. The White House's FY2026 request sought to cut about $491 million and shrink projected headcount from 3,292 to 2,324. Final congressional funding left the topline near $2.6 billion, about $268 million below the prior year. Roughly 1,000 people left through buyouts, early retirements and layoffs, and one June 2026 report put current staff near 2,200 against a level DHS leadership reportedly considers necessary of about 2,800. The same report said the FY2027 request proposes cutting more than $700 million.
Information sharing on a short leash
Another pillar, the Cybersecurity Information Sharing Act of 2015, which gives companies liability protection for sharing threat data, lapsed during last autumn's shutdown. It was revived through January 30, extended to September 30 in the February omnibus, and a stopgap spending bill reported by Federal News Network pushes it to December 11, 2026. Long-term reauthorisation remains stalled, with a House-passed defence bill carrying a longer renewal and Senate disagreement over free-speech protections.
Why it matters
Visibility into attacks on hospitals, utilities and pipelines depends on rules and legal cover that are still provisional. Companies cannot design compliance programs around a rule with no date, yet they may face overlapping obligations from the SEC, the EU and states in the meantime.
The compliance limbo for operators
Critical-infrastructure companies are stuck planning around a rule they cannot read. CIRCIA's proposed version, published in 2024, defined a broad set of covered entities across sectors from energy to healthcare and set the 72-hour and 24-hour clocks. Industry groups argued the scope was too wide, that the definition of a reportable incident captured routine events, and that the rule should harmonise with sector regulators who already collect similar reports. CISA's own explanation for the repeated delays is that it wants to reduce scope and burden and align with other requirements, which suggests the final rule will be narrower than the proposal, but the exact shape remains unknown.
That uncertainty has a cost. Security teams have to decide whether to build reporting pipelines now or wait. Many are building to the most demanding assumption, a 72-hour window with detailed fields, because the work doubles as preparation for the SEC's four-business-day disclosure rule for public companies and for European regimes such as NIS2 and the Cyber Resilience Act, which have their own timers. Lawyers advise mapping a single incident-timeline template that can feed several regulators.
The staffing story matters because a reporting rule only works if someone can use the reports. CISA's value in an incident comes from correlating submissions across sectors, spotting a campaign early and warning others. Fewer analysts, leadership churn under an acting director, and funding battles reduce that capacity. The agency has said it has stabilised, and its acting chief told Congress in January that no further reorganisations were expected in the fiscal year, but critics point to a prolonged absence of a Senate-confirmed director and to the short-term extensions of the information-sharing law as signs of unsettled foundations.
The liability protections in the 2015 sharing law matter here too. Companies share indicators and incident details with the government more readily when they have legal cover against lawsuits and certain regulatory uses. Each lapse, even brief, makes counsel more cautious.
What to watch
- Publication of the CIRCIA final rule and any narrowing of covered sectors.
- Whether Congress passes a multi-year info-sharing reauthorisation before December 11.
- A confirmed CISA director and the FY2027 appropriations outcome.
