United States ·Law

Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)

In force · 15 March 2022

Summary

The law requires critical infrastructure entities to report covered cyber incidents to CISA within 72 hours and ransom payments within 24 hours. It tasks CISA with defining, through rulemaking, the covered entities and reporting procedures. It aims to give the federal government a timely picture of threats so it can warn other potential targets.

Original title

Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)

Title in other languages

• Legge del 2022 sulla notifica degli incidenti informatici per le infrastrutture critiche (CIRCIA)
• Loi de 2022 sur la notification des cyberincidents pour les infrastructures critiques (CIRCIA)
• Ley de 2022 de notificación de ciberincidentes para infraestructuras críticas (CIRCIA)

Jurisdiction

United States

Issuing body

United States Congress

Official number

Pub. L. 117-103, Division Y

Type

Law

Date adopted

15 March 2022

Status

In force

Available languages

English

Topics

• Critical infrastructure
• Incident management / CSIRT

Licence / terms of use

Public domain / official act

Notes

Gli obblighi diventano operativi con la norma finale di attuazione della CISA.

Collected from

manuale

Last verified

26 October 2026 (verified by Claude (seed iniziale, da revisionare in redazione))

United States Congress. (2022). Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) (Pub. L. 117-103, Division Y). https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/cyber-incident-reporting-critical-infrastructure-act-2022-circia

United States Congress. "Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)." 15 March 2022. https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/cyber-incident-reporting-critical-infrastructure-act-2022-circia.

@misc{us_circia_2022,
  author       = {{United States Congress}},
  title        = {{Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)}},
  year         = {2022},
  note         = {Pub. L. 117-103, Division Y},
  url          = {https://www.cisa.gov/topics/cyber-threats-and-advisories/information-sharing/cyber-incident-reporting-critical-infrastructure-act-2022-circia},
  urldate      = {2026-10-26}
}

Report an error in this record