CISA revises town hall schedule to seek stakeholder input on critical infrastructure cyber incident reporting

The Cybersecurity and Infrastructure Security Agency has set a new timeline for a series of virtual town hall meetings on the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) rulemaking, with sessions beginning June 15. The events replace town halls the agency had planned for March and April 2026 but did not hold amid the recent shutdown of the Department of Homeland Security, according to CISA.

The revised schedule is posted in the Federal Register. Stakeholders can register and track any updates at www.cisa.gov/circia.

“CISA is working to maximize the impact of CIRCIA to significantly improve our Nation’s cybersecurity posture. At the same time, CISA values the interest and concern our stakeholders have that CIRCIA will be implemented with minimal unnecessary burden to entities in critical infrastructure sectors,” said CISA Acting Director Nick Andersen. “CISA appreciates our stakeholder’s patience with waiting for our rescheduled town hall meetings to provide their critical input as we finalize this rule. As an agency built on collaboration and coordination, CISA is committed to hearing from the American people, critical infrastructure owners and operators, and other community members.”

CIRCIA, enacted in 2022, is intended to speed the government’s response to cyber threats and bolster information sharing to protect critical infrastructure. Once the final rule takes effect, covered entities would be required to notify CISA of qualifying cyber incidents within 72 hours and any ransom payments within 24 hours.

CISA said it has fielded numerous requests for more opportunities to comment on the rulemaking and will use the town halls to gather feedback on its Notice of Proposed Rulemaking (NPRM) from a wide cross-section of critical infrastructure owners and operators.

The agency issued the NPRM in April 2024 after a nationwide series of in-person listening sessions, virtual sector-specific meetings, and consultations with Sector Risk Management Agencies and other federal partners. The proposal was open for a 90-day public comment period.