The Cybersecurity and Infrastructure Security Agency (CISA) is holding a series of virtual town hall meetings to hear feedback on a rule that requires critical infrastructure companies to report major cyber incidents to the federal government.
The cyber incident reporting rule is required under the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA). The final rule will require covered organizations to report major incidents to CISA within 72 hours and ransom payments within 24 hours.
CISA said it will hold five industry-specific town halls throughout March, with the first session slated for March 9. In addition, the agency will hold two general town hall meetings on March 31 and April 2.
“Implementing CIRCIA will significantly enhance our ability to assist victims of cyber incidents, identify emerging threats, and rapidly share actionable information to protect others,” said CISA Executive Assistant Director for Cybersecurity Nick Andersen in a statement.
“Stakeholder input is critical as we finalize this rule to strengthen our collective defense. CISA is committed to delivering a framework that appropriately balances its impact on improving our nation’s cybersecurity posture with avoiding unnecessary burden to entities in critical infrastructure sectors,” Anderson continued.
It is unclear how those town halls may be affected by the Department of Homeland Security (DHS) shutdown. During a congressional hearing last week, CISA Acting Director Madhu Gottumukkala told lawmakers that a lapse in funding would delay the final rule.
Instead, all functions at CISA would be limited to critical frontline work, Gottumukkala said, but he did not provide details on how long the delay may be for the final CIRCIA rule.
The final rule has already encountered delays. Under CIRCIA, CISA was supposed to enact a final rule in October 2025, though a document from the Office of Management and Budget showed that deadline was extended to this May.