CISA sent the final rule under the Cyber Incident Reporting for Critical Infrastructure Act to the White House Office of Management and Budget for review on October 1, 2026, the last procedural stage before publication. The rule would require covered entities across sixteen critical infrastructure sectors, an estimated 300,000 or more, to report substantial cyber incidents within 72 hours and ransomware payments within 24 hours. The scope could extend to technology, cloud, logistics, engineering and communications vendors serving critical infrastructure clients. Publication is expected before year end.
Covered entities would report substantial cyber incidents within 72 hours and ransomware payments within 24 hours.
An estimated 300,000 or more entities across sixteen critical infrastructure sectors could be covered.
Technology, cloud, logistics, engineering and communications vendors serving critical infrastructure could fall within scope.
Our comment
The rule is not yet in force, but its scope could reach vendors that do not consider themselves covered entities. The question for technology providers serving critical infrastructure clients is whether they would fall within the definitions and how the reporting timelines would interact with existing contractual and regulatory notification duties.
Questions about this alert?
Sara Derbel
Paralegal
Our team can explain what this development means for your organization.
Regulatory intelligence and legislative monitoring for AI, privacy and cybersecurity across Canada, the US, EU, UK and Australia, filtered, prioritized and reviewed by legal experts.
Cyber incident tabletop exercises and simulations for executives and response teams, including ransomware, insider threat and deepfake social engineering scenarios.
The Bundestag passed the Act Implementing the Cyber Resilience Act, designating the BSI as Germany's market surveillance authority, notifying authority and coordinating CSIRT under the CRA. As market surveillance authority, the BSI can order noncompliant products with digital elements removed from the market. It will also act as a complaints office for consumer reports. The Act still requires Bundesrat approval. Once in force, provisions matching CRA obligations that already apply take effect the day after promulgation, and the remaining obligations follow the CRA's general application date of December 11, 2027.
