CIRCIA reporting deadline puts OT data integrity under the microscope | TechTarget
The U.S. government is moving closer to requiring covered critical infrastructure organizations to report significant cyber incidents within 72 hours and ransomware payments within 24 hours. But for operators of industrial control systems, the challenge will extend beyond deadline compliance; they must first determine whether an incident has occurred, establish what was compromised and decide whether the data driving physical processes can still be trusted.
On October 1, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) submitted the draft of its final rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) to the White House Office of Management and Budget and its Office of Information and Regulatory Affairs for interagency review. Publication is expected by the end of 2026.
The rule would establish mandatory reporting requirements for designated critical infrastructure entities, bringing new urgency to incident detection and response in environments where operational...
Copyright of this story solely belongs to www.techtarget.com. To see the full text click HERE
