# CISA Advances Cyber Incident Reporting Rule

State breach-notification rules are tightening, while CISA’s Cyber Incident Reporting for Critical Infrastructure Act (CIRCIA) rule remains under interagency review after submission to OIRA on October 1, 2026. The recap advises companies to prepare for significant-incident reporting within 72 hours, but the rule is not described as finalized or currently effective. These changes are relevant to government contractors and critical-infrastructure suppliers because incident response, supplier security controls, data-broker and AI-related obligations, and potential False Claims Act exposure can affect contract performance and risk.

- Contractors should review applicable state breach-notification timelines and their incident-response processes, including whether they can support a 72-hour reporting timeframe if required by the final CIRCIA rule.
- Procurement and security teams should evaluate supplier security controls and data-handling practices, including relevant data-broker and AI obligations, against their contract requirements.
- Companies serving the federal market should assess how cyber incident representations and security practices could affect False Claims Act exposure.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 06, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)
- Office of Information and Regulatory Affairs (OIRA)
- U.S. Department of Justice (DOJ)
- Federal Communications Commission (FCC)
- U.S. Department of Energy (DOE)

### Sources
- [2026 US data security law recap](https://www.ashurstperkinscoie.com/en/insights/2026-us-data-security-law-recap) - Ashurst Perkins Coie