Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA)
Covered critical infrastructure entities will have to report substantial cyber incidents to CISA within 72 hours and ransom payments within 24 hours, and preserve related data.
Draft mapping. Drafted by the Register's agents from the rule's text and not yet confirmed by a person. It is the Register's reading, not legal advice: whether and how the rule applies to you is a question for counsel.
Controls this rule maps to
Required by the text The rule's text requires a measure that is this control, or plainly includes it. Implied A binding rule whose purpose needs this control, but whose text does not name it. The Register's reading. Recommended A voluntary standard or guidance recommends it; nothing binds you to it. Proposed Appears in a proposed rule or proposed provision that is not yet in force.
| Control | Strength | Where in the rule, and why | Confidence | Missing or failed in |
|---|---|---|---|---|
| Reporting integrity C-V2 | Required by the text | 72-hour incident and 24-hour ransom payment reports, with supplemental reports as facts develop | high | 1 case |
| Independent audit log C-V1 | Proposed | the proposed rule's data preservation requirement for records relating to a reported incident | medium | 1 case |